hawkeye | 0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebe

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2024 22:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
Size

999KB
MD5

db1c31fdb09a47b7215e8869810bec00
SHA1

6c3391975646000d28f4e64a935f738d9d3d62ee
SHA256

0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebe
SHA512

6042ee6b16f7b140460d424d20a9caa95606fcbcab7cb5953c454377e20c0e5ca0f6075f0469ae9a9aa654f48edd85f71b8700f322727c09a1db622d958dfbd5
SSDEEP

24576:ghyp66+rMAW4bzZJfkgmT6sGIcBRLYP64:AypmA4bNJfkgm2sMBRLN4

Score

10^/10

hawkeye collection discovery keylogger spyware stealer trojan

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Hawkeye family
hawkeye

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	CryptSvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	EFS.exe

Executes dropped EXE 4 IoCs

pid	Process
2424	CryptSvc.exe
1072	EFS.exe
3648	EFS.exe
908	CryptSvc.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	whatismyipaddress.com
23	whatismyipaddress.com
41	whatismyipaddress.com

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 1352	1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	95
PID 1352 set thread context of 3540	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	102
PID 1352 set thread context of 844	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	104
PID 1072 set thread context of 3648	1072	EFS.exe	107
PID 3648 set thread context of 2688	3648	EFS.exe	113
PID 3648 set thread context of 4024	3648	EFS.exe	115

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EFS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EFS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
2424	CryptSvc.exe
1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
3648	EFS.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
Token: SeDebugPrivilege	2424	CryptSvc.exe
Token: SeDebugPrivilege	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
Token: SeDebugPrivilege	3540	vbc.exe
Token: SeDebugPrivilege	844	vbc.exe
Token: SeDebugPrivilege	1072	EFS.exe
Token: SeDebugPrivilege	908	CryptSvc.exe
Token: SeDebugPrivilege	3648	EFS.exe
Token: SeDebugPrivilege	2688	vbc.exe
Token: SeDebugPrivilege	4024	vbc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
3648	EFS.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1352	1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	95
PID 1668 wrote to memory of 1352	1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	95
PID 1668 wrote to memory of 1352	1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	95
PID 1668 wrote to memory of 1352	1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	95
PID 1668 wrote to memory of 1352	1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	95
PID 1668 wrote to memory of 1352	1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	95
PID 1668 wrote to memory of 1352	1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	95
PID 1668 wrote to memory of 1352	1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	95
PID 1668 wrote to memory of 2424	1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	96
PID 1668 wrote to memory of 2424	1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	96
PID 1668 wrote to memory of 2424	1668	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	96
PID 2424 wrote to memory of 1072	2424	CryptSvc.exe	98
PID 2424 wrote to memory of 1072	2424	CryptSvc.exe	98
PID 2424 wrote to memory of 1072	2424	CryptSvc.exe	98
PID 1352 wrote to memory of 3540	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	102
PID 1352 wrote to memory of 3540	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	102
PID 1352 wrote to memory of 3540	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	102
PID 1352 wrote to memory of 3540	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	102
PID 1352 wrote to memory of 3540	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	102
PID 1352 wrote to memory of 3540	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	102
PID 1352 wrote to memory of 3540	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	102
PID 1352 wrote to memory of 3540	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	102
PID 1352 wrote to memory of 3540	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	102
PID 1352 wrote to memory of 844	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	104
PID 1352 wrote to memory of 844	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	104
PID 1352 wrote to memory of 844	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	104
PID 1352 wrote to memory of 844	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	104
PID 1352 wrote to memory of 844	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	104
PID 1352 wrote to memory of 844	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	104
PID 1352 wrote to memory of 844	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	104
PID 1352 wrote to memory of 844	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	104
PID 1352 wrote to memory of 844	1352	0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe	104
PID 1072 wrote to memory of 3648	1072	EFS.exe	107
PID 1072 wrote to memory of 3648	1072	EFS.exe	107
PID 1072 wrote to memory of 3648	1072	EFS.exe	107
PID 1072 wrote to memory of 3648	1072	EFS.exe	107
PID 1072 wrote to memory of 3648	1072	EFS.exe	107
PID 1072 wrote to memory of 3648	1072	EFS.exe	107
PID 1072 wrote to memory of 3648	1072	EFS.exe	107
PID 1072 wrote to memory of 3648	1072	EFS.exe	107
PID 1072 wrote to memory of 908	1072	EFS.exe	108
PID 1072 wrote to memory of 908	1072	EFS.exe	108
PID 1072 wrote to memory of 908	1072	EFS.exe	108
PID 3648 wrote to memory of 2688	3648	EFS.exe	113
PID 3648 wrote to memory of 2688	3648	EFS.exe	113
PID 3648 wrote to memory of 2688	3648	EFS.exe	113
PID 3648 wrote to memory of 2688	3648	EFS.exe	113
PID 3648 wrote to memory of 2688	3648	EFS.exe	113
PID 3648 wrote to memory of 2688	3648	EFS.exe	113
PID 3648 wrote to memory of 2688	3648	EFS.exe	113
PID 3648 wrote to memory of 2688	3648	EFS.exe	113
PID 3648 wrote to memory of 2688	3648	EFS.exe	113
PID 3648 wrote to memory of 4024	3648	EFS.exe	115
PID 3648 wrote to memory of 4024	3648	EFS.exe	115
PID 3648 wrote to memory of 4024	3648	EFS.exe	115
PID 3648 wrote to memory of 4024	3648	EFS.exe	115
PID 3648 wrote to memory of 4024	3648	EFS.exe	115
PID 3648 wrote to memory of 4024	3648	EFS.exe	115
PID 3648 wrote to memory of 4024	3648	EFS.exe	115
PID 3648 wrote to memory of 4024	3648	EFS.exe	115
PID 3648 wrote to memory of 4024	3648	EFS.exe	115

C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
"C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
  "C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
    3⤵
    - Accesses Microsoft Outlook accounts
    - Suspicious use of AdjustPrivilegeToken
    PID:3540
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:844
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: SetClipboardViewer
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3648
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
        5⤵
        Accesses Microsoft Outlook accounts
        Suspicious use of AdjustPrivilegeToken
        
        PID:2688
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4024
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\CryptSvc.exe.log

Filesize
128B

MD5
a5dcc7c9c08af7dddd82be5b036a4416

SHA1
4f998ca1526d199e355ffb435bae111a2779b994

SHA256
e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5

SHA512
56035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\holdermail.txt

Filesize
321B

MD5
e62221a3bb549a72fcc4afa60d34e620

SHA1
d60b16b540e0e3ed459a30cce0678d1fc8a1989a

SHA256
587f8f51485b575f30e5e1608f70b31b9d8bb384318802373cc52cbdf2a4aa95

SHA512
5b6f6a3a88961b62870e486b02e41d065b3f054f3ad45f7c7e01aff3ba151893e36fd3c13771ed9e3738aaa525296a8ee72adc05fb32932ec3af259404172aed

Download Submit
C:\Users\Admin\AppData\Local\Temp\holdermail.txt

Filesize
321B

MD5
c3609e29395ccd5fd8407fed36414e75

SHA1
04c0c5dc3fcced0c5581c44af17fa60260fb591a

SHA256
a32df1c247d5738af4241edc4aa520dbb21013d05d47cac5db96ccfb48de7857

SHA512
8bbd7b458f2be6e91c46cad8f682e109c7a7317f9ae89e5ce889ae7d4db5775b83d03016f47b56aa75bd5646a50c06ae7adbf2fc8af6b9f8a976f2ce30de3533

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe

Filesize
8KB

MD5
e5cfadb65f5a6b27b6a559cb3c286b95

SHA1
f33ab26def2759aad5248cf1affa413777148584

SHA256
251b78d864900e3a2b6cc168463421e1bc4ca31bfcabe941b595989bda0e5314

SHA512
b833256eb469717036cd81673e6b4d2bfa00093955b3d202fcfade785f530c51ccb9c23d883f3d263b985996560f3e67d5c7df51963974b526c79f3ded043d9b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe

Filesize
999KB

MD5
db1c31fdb09a47b7215e8869810bec00

SHA1
6c3391975646000d28f4e64a935f738d9d3d62ee

SHA256
0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebe

SHA512
6042ee6b16f7b140460d424d20a9caa95606fcbcab7cb5953c454377e20c0e5ca0f6075f0469ae9a9aa654f48edd85f71b8700f322727c09a1db622d958dfbd5

Download Submit
C:\Users\Admin\AppData\Roaming\pid.txt

Filesize
4B

MD5
8b0dc65f996f98fd178a9defd0efa077

SHA1
fbd5c4e21f715ae152acdd465b3e5bcf3077d0fd

SHA256
9d551151d715267077b3a4a41ac5652b5887a82bd8e5ebdd085386a093cd1a89

SHA512
92ab4a717d505020b29a58c1c86bb4603701342fbb919effdbf703815647d17083f83962718c9fe9a5c9bdbcb7bb3f5ccd417b12c0a5e11fc1682b6dce7a0708

Download Submit
C:\Users\Admin\AppData\Roaming\pidloc.txt

Filesize
103B

MD5
03692d53dbd9e60ada8e30719b23eb12

SHA1
3ed8a578da64ef21ce57c103d199bb68e6404430

SHA256
dd7a8568eb52677abdf357f0d93622ab6bc8578dcd87b5af53cb01ae21119d9b

SHA512
8940533e42b1fb1d9f4740c5c2708f6268f4ab708f796f12a2d6547663c64ff23e978fad29d83ea07c23ac3d546023b3cd1b1a9cc61c8145a3fd20f0e0c29f7a

Download Submit
memory/844-51-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/844-40-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/844-41-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1352-10-0x0000000074890000-0x0000000074E41000-memory.dmp

Filesize
5.7MB

Download
memory/1352-9-0x0000000074890000-0x0000000074E41000-memory.dmp

Filesize
5.7MB

Download
memory/1352-38-0x0000000074890000-0x0000000074E41000-memory.dmp

Filesize
5.7MB

Download
memory/1352-8-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/1668-2-0x0000000074890000-0x0000000074E41000-memory.dmp

Filesize
5.7MB

Download
memory/1668-53-0x0000000074890000-0x0000000074E41000-memory.dmp

Filesize
5.7MB

Download
memory/1668-5-0x0000000074890000-0x0000000074E41000-memory.dmp

Filesize
5.7MB

Download
memory/1668-0-0x0000000074892000-0x0000000074893000-memory.dmp

Filesize
4KB

Download
memory/1668-37-0x0000000074890000-0x0000000074E41000-memory.dmp

Filesize
5.7MB

Download
memory/1668-3-0x0000000074892000-0x0000000074893000-memory.dmp

Filesize
4KB

Download
memory/1668-4-0x0000000074890000-0x0000000074E41000-memory.dmp

Filesize
5.7MB

Download
memory/1668-1-0x0000000074890000-0x0000000074E41000-memory.dmp

Filesize
5.7MB

Download
memory/2424-55-0x0000000074890000-0x0000000074E41000-memory.dmp

Filesize
5.7MB

Download
memory/2424-39-0x0000000074890000-0x0000000074E41000-memory.dmp

Filesize
5.7MB

Download
memory/2424-23-0x0000000074890000-0x0000000074E41000-memory.dmp

Filesize
5.7MB

Download
memory/2424-22-0x0000000074890000-0x0000000074E41000-memory.dmp

Filesize
5.7MB

Download
memory/2424-21-0x0000000074890000-0x0000000074E41000-memory.dmp

Filesize
5.7MB

Download
memory/2688-75-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2688-82-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3540-36-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3540-29-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3540-28-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4024-84-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4024-90-0x0000000000470000-0x0000000000539000-memory.dmp

Filesize
804KB

Download
memory/4024-94-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download