Malware Analysis Report

2025-01-02 14:12

Sample ID 221001-282wqsbea7
Target 96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88
SHA256 96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88
Tags
agilenet hawkeye collection keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88

Threat Level: Known bad

The file 96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88 was found to be: Known bad.

Malicious Activity Summary

agilenet hawkeye collection keylogger spyware stealer trojan

HawkEye

Executes dropped EXE

Reads user/profile data of web browsers

Uses the VBS compiler for execution

Checks computer location settings

Obfuscated with Agile.Net obfuscator

Loads dropped DLL

Reads local data of messenger clients

Looks up external IP address via web service

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: SetClipboardViewer

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-01 23:15

Signatures

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-01 23:15

Reported

2022-10-02 01:34

Platform

win7-20220812-en

Max time kernel

153s

Max time network

107s

Command Line

"C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads local data of messenger clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1928 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1928 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1928 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1928 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1928 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1928 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1928 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1928 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1928 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1928 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1928 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1928 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1928 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe
PID 1928 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe
PID 1928 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe
PID 1928 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe
PID 1764 wrote to memory of 548 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe
PID 1764 wrote to memory of 548 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe
PID 1764 wrote to memory of 548 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe
PID 1764 wrote to memory of 548 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe
PID 1344 wrote to memory of 2020 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 2020 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 2020 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 2020 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 2020 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 2020 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 2020 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 2020 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 2020 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 2020 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 1972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 1972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 1972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 1972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 1972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 1972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 1972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 1972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 1972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1344 wrote to memory of 1972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 548 wrote to memory of 272 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 548 wrote to memory of 272 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 548 wrote to memory of 272 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 548 wrote to memory of 272 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 548 wrote to memory of 272 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 548 wrote to memory of 272 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 548 wrote to memory of 272 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 548 wrote to memory of 272 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 548 wrote to memory of 272 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 548 wrote to memory of 272 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 548 wrote to memory of 272 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 548 wrote to memory of 272 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe

"C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.154.36:80 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp
US 8.8.8.8:53 smtp.masterwork123.eu udp
US 8.8.8.8:53 smtp.masterwork123.eu udp

Files

memory/1928-54-0x0000000075E11000-0x0000000075E13000-memory.dmp

memory/1928-55-0x0000000074940000-0x0000000074EEB000-memory.dmp

memory/1928-56-0x0000000074940000-0x0000000074EEB000-memory.dmp

memory/1344-57-0x0000000000400000-0x000000000049C000-memory.dmp

memory/1344-58-0x0000000000400000-0x000000000049C000-memory.dmp

memory/1344-60-0x0000000000400000-0x000000000049C000-memory.dmp

memory/1344-62-0x0000000000400000-0x000000000049C000-memory.dmp

memory/1344-63-0x0000000000400000-0x000000000049C000-memory.dmp

memory/1344-64-0x0000000000494EFE-mapping.dmp

memory/1344-66-0x0000000000400000-0x000000000049C000-memory.dmp

memory/1344-68-0x0000000000400000-0x000000000049C000-memory.dmp

memory/1344-70-0x0000000074940000-0x0000000074EEB000-memory.dmp

memory/1764-72-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe

MD5 30dcffe799151cc2c5a7f1f6918f2cbb
SHA1 c52cdf32b4775faecb29f6f5394d1030ed67e131
SHA256 7bbcad36e64af85ca9c49adf23eb693d18c7ecf41aa7ed7f7b7e83c2404df77e
SHA512 3f805d65e365f1fe7e6364aceaadead99321efb37d371f954be041bca28075cf4e75d82b6649c65e2d90b98ae5b720dc350c5535d33b7461c449ab1a1d6483a6

\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe

MD5 30dcffe799151cc2c5a7f1f6918f2cbb
SHA1 c52cdf32b4775faecb29f6f5394d1030ed67e131
SHA256 7bbcad36e64af85ca9c49adf23eb693d18c7ecf41aa7ed7f7b7e83c2404df77e
SHA512 3f805d65e365f1fe7e6364aceaadead99321efb37d371f954be041bca28075cf4e75d82b6649c65e2d90b98ae5b720dc350c5535d33b7461c449ab1a1d6483a6

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe

MD5 30dcffe799151cc2c5a7f1f6918f2cbb
SHA1 c52cdf32b4775faecb29f6f5394d1030ed67e131
SHA256 7bbcad36e64af85ca9c49adf23eb693d18c7ecf41aa7ed7f7b7e83c2404df77e
SHA512 3f805d65e365f1fe7e6364aceaadead99321efb37d371f954be041bca28075cf4e75d82b6649c65e2d90b98ae5b720dc350c5535d33b7461c449ab1a1d6483a6

memory/1764-76-0x0000000074940000-0x0000000074EEB000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe

MD5 7349759813699be272126c1752ea0900
SHA1 e7a9b949136999eca4b594fc23ef6a8dde3869ae
SHA256 96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88
SHA512 5b2c92cb2e56d8372c7fc3f9a1ed647b8ed515be497b4207fa96ad505a402d9fd06158b8966ecb1fdbab02a1a822f3d9bb50ad11705c26097eae96c2776006eb

\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe

MD5 7349759813699be272126c1752ea0900
SHA1 e7a9b949136999eca4b594fc23ef6a8dde3869ae
SHA256 96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88
SHA512 5b2c92cb2e56d8372c7fc3f9a1ed647b8ed515be497b4207fa96ad505a402d9fd06158b8966ecb1fdbab02a1a822f3d9bb50ad11705c26097eae96c2776006eb

memory/548-79-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe

MD5 7349759813699be272126c1752ea0900
SHA1 e7a9b949136999eca4b594fc23ef6a8dde3869ae
SHA256 96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88
SHA512 5b2c92cb2e56d8372c7fc3f9a1ed647b8ed515be497b4207fa96ad505a402d9fd06158b8966ecb1fdbab02a1a822f3d9bb50ad11705c26097eae96c2776006eb

memory/548-82-0x0000000074940000-0x0000000074EEB000-memory.dmp

memory/1344-83-0x0000000000225000-0x0000000000236000-memory.dmp

memory/1344-84-0x0000000074940000-0x0000000074EEB000-memory.dmp

memory/2020-94-0x000000000040582F-mapping.dmp

memory/2020-93-0x0000000000400000-0x0000000000422000-memory.dmp

memory/2020-92-0x0000000000400000-0x0000000000422000-memory.dmp

memory/2020-96-0x0000000000400000-0x0000000000422000-memory.dmp

memory/2020-90-0x0000000000400000-0x0000000000422000-memory.dmp

memory/2020-88-0x0000000000400000-0x0000000000422000-memory.dmp

memory/2020-86-0x0000000000400000-0x0000000000422000-memory.dmp

memory/2020-85-0x0000000000400000-0x0000000000422000-memory.dmp

memory/2020-98-0x0000000000400000-0x0000000000422000-memory.dmp

memory/1764-97-0x0000000074940000-0x0000000074EEB000-memory.dmp

memory/548-99-0x0000000074940000-0x0000000074EEB000-memory.dmp

memory/1972-100-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1972-101-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1972-103-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1972-105-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1972-107-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1972-108-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1972-109-0x0000000000442872-mapping.dmp

memory/1972-114-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2020-113-0x0000000000400000-0x0000000000422000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holdermail.txt

MD5 a18df529a77ed1fbd887400151b9728f
SHA1 74912cb5e97566749ccae5f70e52ee87cb4dfa07
SHA256 599ceb2fab753551e7b27340cd3a9d2eb44a887dfb178d1c05015159bb352eb3
SHA512 a446e30992bc63b53952982e06069555e9b65eb25274495470d4410a04bcc9aeaa96b95300fc89512181e0614abf279f439b52f32ffc6ffb3034230c97aa08b0

C:\Users\Admin\AppData\Local\Temp\holdermail.txt

MD5 e4f3273432f9167e5f8bd2048206773d
SHA1 139b6566c6f8c6a359dd7e6063f88be24f701c8d
SHA256 b620b529c43ed1dab8db9c63b402958e1a0b65c9110029b92ac8ae2c21c0acb2
SHA512 e1bf722b627cd5f1e1678549d51f9556a1d31c8e5f47dfbe343c81aef7bac279ca2b062751666d650b2c196785a84b0d2edca09d1a04b829f4ae869e513e6941

memory/1972-115-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1972-117-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1344-118-0x0000000000225000-0x0000000000236000-memory.dmp

memory/272-126-0x0000000000494EFE-mapping.dmp

C:\Users\Admin\AppData\Roaming\pid.txt

MD5 a50abba8132a77191791390c3eb19fe7
SHA1 bf106f603f5a1ca065cb9438fb4eae247d89aef3
SHA256 aa13fda43018c393de7088225497fee24270d428a9de0d2f8d0cc899f6687e69
SHA512 6a4dc31d90f7d7ed08ac21150bdfbfc121abbf907482b85c0aa34e64b6f5b989ef6a59024311fedd098eec77a898bfe4e1ef591dae6d2ebbf76b510810b91f39

memory/272-133-0x0000000074940000-0x0000000074EEB000-memory.dmp

memory/272-134-0x0000000074940000-0x0000000074EEB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-01 23:15

Reported

2022-10-02 01:34

Platform

win10v2004-20220812-en

Max time kernel

163s

Max time network

170s

Command Line

"C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads local data of messenger clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3336 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3336 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3336 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3336 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3336 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3336 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3336 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3336 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3336 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe
PID 3336 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe
PID 3336 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe
PID 4824 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe
PID 4824 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe
PID 4824 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe
PID 2712 wrote to memory of 4896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2712 wrote to memory of 4896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2712 wrote to memory of 4896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2712 wrote to memory of 4896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2712 wrote to memory of 4896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2712 wrote to memory of 4896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2712 wrote to memory of 4896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2712 wrote to memory of 4896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2712 wrote to memory of 4896 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2712 wrote to memory of 2484 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2712 wrote to memory of 2484 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2712 wrote to memory of 2484 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2712 wrote to memory of 2484 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2712 wrote to memory of 2484 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2712 wrote to memory of 2484 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2712 wrote to memory of 2484 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2712 wrote to memory of 2484 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2712 wrote to memory of 2484 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4124 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4124 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4124 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4124 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4124 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4124 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4124 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4124 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1136 wrote to memory of 632 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1136 wrote to memory of 632 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1136 wrote to memory of 632 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1136 wrote to memory of 632 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1136 wrote to memory of 632 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1136 wrote to memory of 632 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1136 wrote to memory of 632 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1136 wrote to memory of 632 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1136 wrote to memory of 632 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1136 wrote to memory of 4816 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1136 wrote to memory of 4816 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1136 wrote to memory of 4816 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1136 wrote to memory of 4816 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1136 wrote to memory of 4816 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1136 wrote to memory of 4816 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1136 wrote to memory of 4816 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1136 wrote to memory of 4816 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1136 wrote to memory of 4816 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe

"C:\Users\Admin\AppData\Local\Temp\96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
NL 8.238.23.254:80 tcp
NL 8.238.23.254:80 tcp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 97.97.242.52.in-addr.arpa udp
DE 51.116.253.170:443 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 106.89.54.20.in-addr.arpa udp
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.16.154.36:80 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 smtp.masterwork123.eu udp
US 104.16.154.36:80 whatismyipaddress.com tcp
US 104.16.154.36:443 whatismyipaddress.com tcp
US 8.8.8.8:53 smtp.masterwork123.eu udp
US 8.8.8.8:53 smtp.masterwork123.eu udp

Files

memory/3336-132-0x0000000074ED0000-0x0000000075481000-memory.dmp

memory/3336-133-0x0000000074ED0000-0x0000000075481000-memory.dmp

memory/2712-134-0x0000000000000000-mapping.dmp

memory/2712-136-0x0000000074ED0000-0x0000000075481000-memory.dmp

memory/4824-137-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe

MD5 30dcffe799151cc2c5a7f1f6918f2cbb
SHA1 c52cdf32b4775faecb29f6f5394d1030ed67e131
SHA256 7bbcad36e64af85ca9c49adf23eb693d18c7ecf41aa7ed7f7b7e83c2404df77e
SHA512 3f805d65e365f1fe7e6364aceaadead99321efb37d371f954be041bca28075cf4e75d82b6649c65e2d90b98ae5b720dc350c5535d33b7461c449ab1a1d6483a6

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe

MD5 30dcffe799151cc2c5a7f1f6918f2cbb
SHA1 c52cdf32b4775faecb29f6f5394d1030ed67e131
SHA256 7bbcad36e64af85ca9c49adf23eb693d18c7ecf41aa7ed7f7b7e83c2404df77e
SHA512 3f805d65e365f1fe7e6364aceaadead99321efb37d371f954be041bca28075cf4e75d82b6649c65e2d90b98ae5b720dc350c5535d33b7461c449ab1a1d6483a6

memory/4824-140-0x0000000074ED0000-0x0000000075481000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe

MD5 7349759813699be272126c1752ea0900
SHA1 e7a9b949136999eca4b594fc23ef6a8dde3869ae
SHA256 96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88
SHA512 5b2c92cb2e56d8372c7fc3f9a1ed647b8ed515be497b4207fa96ad505a402d9fd06158b8966ecb1fdbab02a1a822f3d9bb50ad11705c26097eae96c2776006eb

memory/4124-141-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe

MD5 7349759813699be272126c1752ea0900
SHA1 e7a9b949136999eca4b594fc23ef6a8dde3869ae
SHA256 96df2e3f39f59c573c66f0c750b7aff440b6fbfc92bc1101407d91e6eb03ed88
SHA512 5b2c92cb2e56d8372c7fc3f9a1ed647b8ed515be497b4207fa96ad505a402d9fd06158b8966ecb1fdbab02a1a822f3d9bb50ad11705c26097eae96c2776006eb

memory/4124-144-0x0000000074ED0000-0x0000000075481000-memory.dmp

memory/4896-146-0x0000000000400000-0x0000000000422000-memory.dmp

memory/4896-150-0x0000000000400000-0x0000000000422000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holdermail.txt

MD5 a18df529a77ed1fbd887400151b9728f
SHA1 74912cb5e97566749ccae5f70e52ee87cb4dfa07
SHA256 599ceb2fab753551e7b27340cd3a9d2eb44a887dfb178d1c05015159bb352eb3
SHA512 a446e30992bc63b53952982e06069555e9b65eb25274495470d4410a04bcc9aeaa96b95300fc89512181e0614abf279f439b52f32ffc6ffb3034230c97aa08b0

memory/4896-148-0x0000000000400000-0x0000000000422000-memory.dmp

memory/4896-147-0x0000000000400000-0x0000000000422000-memory.dmp

memory/4896-145-0x0000000000000000-mapping.dmp

memory/2712-151-0x0000000074ED0000-0x0000000075481000-memory.dmp

memory/4824-152-0x0000000074ED0000-0x0000000075481000-memory.dmp

memory/4124-153-0x0000000074ED0000-0x0000000075481000-memory.dmp

memory/2484-155-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2484-156-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2484-157-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2484-154-0x0000000000000000-mapping.dmp

memory/2484-158-0x0000000000400000-0x000000000046E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holdermail.txt

MD5 e4f3273432f9167e5f8bd2048206773d
SHA1 139b6566c6f8c6a359dd7e6063f88be24f701c8d
SHA256 b620b529c43ed1dab8db9c63b402958e1a0b65c9110029b92ac8ae2c21c0acb2
SHA512 e1bf722b627cd5f1e1678549d51f9556a1d31c8e5f47dfbe343c81aef7bac279ca2b062751666d650b2c196785a84b0d2edca09d1a04b829f4ae869e513e6941

memory/2484-160-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1136-161-0x0000000000000000-mapping.dmp

memory/3336-163-0x0000000074ED0000-0x0000000075481000-memory.dmp

memory/1136-162-0x0000000000400000-0x000000000049C000-memory.dmp

C:\Users\Admin\AppData\Roaming\pidloc.txt

MD5 efd1636cfc3cc38fd7babae5cac9ede0
SHA1 4d7d378abeb682eefbd039930c0ea996fbf54178
SHA256 f827d5b11c1eb3902d601c3e0b59ba32fe11c0b573fbf22fb2af86bfd4651bba
SHA512 69b2b0ab1a6e13395ef52dcb903b8e17d842e6d0d44f801ff2659cfd5ec343c8cc57928b02961fc7099ad43ff05633baf5ac39042a00c8676d4fa8f6f8c2a5d7

C:\Users\Admin\AppData\Roaming\pid.txt

MD5 bbeb0c1b1fd44e392c7ce2fdbd137e87
SHA1 d5759c2495f730727f0b8ba13b00faaca7f7a2dc
SHA256 abf6c4227a94db45b60b02f1e54c5b82f00e5932ed31b7f42b504665ca3dd21f
SHA512 5bbf5b12c20f458f9a363861b5856c51a870bef21ebc32a188eb0114ee1c4f26dff33a97f363bb1b775f253bc5c88d994f3d9de367415749c317c23d44862bd6

memory/1136-166-0x0000000074ED0000-0x0000000075481000-memory.dmp

memory/632-167-0x0000000000000000-mapping.dmp

memory/632-169-0x0000000000400000-0x0000000000422000-memory.dmp

memory/632-170-0x0000000000400000-0x0000000000422000-memory.dmp

memory/632-171-0x0000000000400000-0x0000000000422000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holdermail.txt

MD5 a18df529a77ed1fbd887400151b9728f
SHA1 74912cb5e97566749ccae5f70e52ee87cb4dfa07
SHA256 599ceb2fab753551e7b27340cd3a9d2eb44a887dfb178d1c05015159bb352eb3
SHA512 a446e30992bc63b53952982e06069555e9b65eb25274495470d4410a04bcc9aeaa96b95300fc89512181e0614abf279f439b52f32ffc6ffb3034230c97aa08b0

memory/1136-173-0x0000000074ED0000-0x0000000075481000-memory.dmp

memory/4816-174-0x0000000000000000-mapping.dmp

memory/4816-176-0x0000000000400000-0x000000000046E000-memory.dmp

memory/4816-177-0x0000000000400000-0x000000000046E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holdermail.txt

MD5 e4f3273432f9167e5f8bd2048206773d
SHA1 139b6566c6f8c6a359dd7e6063f88be24f701c8d
SHA256 b620b529c43ed1dab8db9c63b402958e1a0b65c9110029b92ac8ae2c21c0acb2
SHA512 e1bf722b627cd5f1e1678549d51f9556a1d31c8e5f47dfbe343c81aef7bac279ca2b062751666d650b2c196785a84b0d2edca09d1a04b829f4ae869e513e6941

memory/4816-179-0x0000000000400000-0x000000000046E000-memory.dmp