Malware Analysis Report

2025-01-02 13:35

Sample ID 241202-2nqmzawqhx
Target 0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
SHA256 0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebe
Tags
hawkeye collection discovery keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebe

Threat Level: Known bad

The file 0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe was found to be: Known bad.

Malicious Activity Summary

hawkeye collection discovery keylogger spyware stealer trojan

HawkEye

Hawkeye family

Uses the VBS compiler for execution

Reads user/profile data of web browsers

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Reads local data of messenger clients

Looks up external IP address via web service

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: SetClipboardViewer

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-02 22:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-02 22:43

Reported

2024-12-02 22:46

Platform

win7-20240708-en

Max time kernel

120s

Max time network

54s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Hawkeye family

hawkeye

Reads local data of messenger clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2568 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
PID 2568 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
PID 2568 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
PID 2568 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
PID 2568 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
PID 2568 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
PID 2568 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
PID 2568 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
PID 2568 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
PID 2568 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe
PID 2568 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe
PID 2568 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe
PID 2568 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe
PID 2020 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 2020 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 2020 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 2020 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 2744 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2744 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2568 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe
PID 2568 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe
PID 2568 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe
PID 2568 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe
PID 2780 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 2780 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 2780 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 2780 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 2780 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 2780 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 2780 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 2780 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 2780 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe

"C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe"

C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe

"C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.19.222.79:80 whatismyipaddress.com tcp
US 104.19.222.79:443 whatismyipaddress.com tcp
US 104.19.222.79:443 whatismyipaddress.com tcp
US 8.8.8.8:53 mail.avesta.co.id udp
ID 180.235.149.138:587 mail.avesta.co.id tcp
ID 180.235.149.138:587 mail.avesta.co.id tcp

Files

memory/2568-0-0x0000000074771000-0x0000000074772000-memory.dmp

memory/2568-1-0x0000000074770000-0x0000000074D1B000-memory.dmp

memory/2568-2-0x0000000074770000-0x0000000074D1B000-memory.dmp

memory/2568-3-0x0000000074770000-0x0000000074D1B000-memory.dmp

memory/2744-6-0x0000000000400000-0x00000000004E6000-memory.dmp

memory/2744-18-0x0000000000400000-0x00000000004E6000-memory.dmp

memory/2744-16-0x0000000000400000-0x00000000004E6000-memory.dmp

memory/2744-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2744-12-0x0000000000400000-0x00000000004E6000-memory.dmp

memory/2744-10-0x0000000000400000-0x00000000004E6000-memory.dmp

memory/2744-8-0x0000000000400000-0x00000000004E6000-memory.dmp

memory/2744-20-0x0000000000400000-0x00000000004E6000-memory.dmp

memory/2744-21-0x0000000074770000-0x0000000074D1B000-memory.dmp

memory/2744-22-0x0000000074770000-0x0000000074D1B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe

MD5 e5cfadb65f5a6b27b6a559cb3c286b95
SHA1 f33ab26def2759aad5248cf1affa413777148584
SHA256 251b78d864900e3a2b6cc168463421e1bc4ca31bfcabe941b595989bda0e5314
SHA512 b833256eb469717036cd81673e6b4d2bfa00093955b3d202fcfade785f530c51ccb9c23d883f3d263b985996560f3e67d5c7df51963974b526c79f3ded043d9b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe

MD5 db1c31fdb09a47b7215e8869810bec00
SHA1 6c3391975646000d28f4e64a935f738d9d3d62ee
SHA256 0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebe
SHA512 6042ee6b16f7b140460d424d20a9caa95606fcbcab7cb5953c454377e20c0e5ca0f6075f0469ae9a9aa654f48edd85f71b8700f322727c09a1db622d958dfbd5

memory/2020-33-0x0000000074770000-0x0000000074D1B000-memory.dmp

memory/2744-32-0x0000000074770000-0x0000000074D1B000-memory.dmp

memory/2444-36-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2444-37-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2744-38-0x0000000074770000-0x0000000074D1B000-memory.dmp

memory/2744-39-0x0000000074770000-0x0000000074D1B000-memory.dmp

memory/2744-40-0x0000000074770000-0x0000000074D1B000-memory.dmp

memory/2020-41-0x0000000074770000-0x0000000074D1B000-memory.dmp

memory/2444-47-0x0000000000400000-0x000000000046E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holdermail.txt

MD5 e62221a3bb549a72fcc4afa60d34e620
SHA1 d60b16b540e0e3ed459a30cce0678d1fc8a1989a
SHA256 587f8f51485b575f30e5e1608f70b31b9d8bb384318802373cc52cbdf2a4aa95
SHA512 5b6f6a3a88961b62870e486b02e41d065b3f054f3ad45f7c7e01aff3ba151893e36fd3c13771ed9e3738aaa525296a8ee72adc05fb32932ec3af259404172aed

memory/1612-48-0x0000000000400000-0x000000000046F000-memory.dmp

memory/1612-49-0x0000000000400000-0x000000000046F000-memory.dmp

memory/1612-55-0x0000000000400000-0x000000000046F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holdermail.txt

MD5 c3609e29395ccd5fd8407fed36414e75
SHA1 04c0c5dc3fcced0c5581c44af17fa60260fb591a
SHA256 a32df1c247d5738af4241edc4aa520dbb21013d05d47cac5db96ccfb48de7857
SHA512 8bbd7b458f2be6e91c46cad8f682e109c7a7317f9ae89e5ce889ae7d4db5775b83d03016f47b56aa75bd5646a50c06ae7adbf2fc8af6b9f8a976f2ce30de3533

memory/1612-54-0x0000000000470000-0x00000000005F1000-memory.dmp

memory/2020-60-0x0000000074770000-0x0000000074D1B000-memory.dmp

memory/2100-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Users\Admin\AppData\Roaming\pid.txt

MD5 5a45828dead8c065099cb653a2185df1
SHA1 313356f0d1754c304429ead3a51f38a36bb028c7
SHA256 c4b6fe20fadf12a363d8583f4a43eaf17bdffe8c65aa383e15cd0f38ee7acdc5
SHA512 27e4352ac9786dfbf7c37c9299c61299dcf946826b3bf2e61009adabfc8447ec379f764d26a85e0dd43779482030a38e041830789843aa6d405ec4f21e1577b8

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-02 22:43

Reported

2024-12-02 22:46

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Hawkeye family

hawkeye

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe N/A

Reads local data of messenger clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1668 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
PID 1668 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
PID 1668 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
PID 1668 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
PID 1668 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
PID 1668 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
PID 1668 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
PID 1668 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
PID 1668 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe
PID 1668 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe
PID 1668 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe
PID 2424 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 2424 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 2424 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 1352 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1352 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1352 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1352 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1352 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1352 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1352 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1352 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1352 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1352 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1352 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1352 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1352 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1352 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1352 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1352 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1352 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1352 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1072 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 1072 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 1072 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 1072 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 1072 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 1072 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 1072 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 1072 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe
PID 1072 wrote to memory of 908 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe
PID 1072 wrote to memory of 908 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe
PID 1072 wrote to memory of 908 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe
PID 3648 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3648 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3648 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3648 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3648 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3648 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3648 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3648 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3648 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3648 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3648 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3648 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3648 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3648 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3648 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3648 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3648 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3648 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe

"C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe"

C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe

"C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.19.223.79:80 whatismyipaddress.com tcp
US 104.19.223.79:443 whatismyipaddress.com tcp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 79.223.19.104.in-addr.arpa udp
US 8.8.8.8:53 mail.avesta.co.id udp
ID 180.235.149.138:587 mail.avesta.co.id tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 138.149.235.180.in-addr.arpa udp
ID 180.235.149.138:587 mail.avesta.co.id tcp
US 104.19.223.79:80 whatismyipaddress.com tcp
US 104.19.223.79:443 whatismyipaddress.com tcp
ID 180.235.149.138:587 mail.avesta.co.id tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
ID 180.235.149.138:587 mail.avesta.co.id tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

memory/1668-0-0x0000000074892000-0x0000000074893000-memory.dmp

memory/1668-1-0x0000000074890000-0x0000000074E41000-memory.dmp

memory/1668-2-0x0000000074890000-0x0000000074E41000-memory.dmp

memory/1668-3-0x0000000074892000-0x0000000074893000-memory.dmp

memory/1668-4-0x0000000074890000-0x0000000074E41000-memory.dmp

memory/1668-5-0x0000000074890000-0x0000000074E41000-memory.dmp

memory/1352-8-0x0000000000400000-0x00000000004E6000-memory.dmp

memory/1352-9-0x0000000074890000-0x0000000074E41000-memory.dmp

memory/1352-10-0x0000000074890000-0x0000000074E41000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe

MD5 e5cfadb65f5a6b27b6a559cb3c286b95
SHA1 f33ab26def2759aad5248cf1affa413777148584
SHA256 251b78d864900e3a2b6cc168463421e1bc4ca31bfcabe941b595989bda0e5314
SHA512 b833256eb469717036cd81673e6b4d2bfa00093955b3d202fcfade785f530c51ccb9c23d883f3d263b985996560f3e67d5c7df51963974b526c79f3ded043d9b

memory/2424-21-0x0000000074890000-0x0000000074E41000-memory.dmp

memory/2424-22-0x0000000074890000-0x0000000074E41000-memory.dmp

memory/2424-23-0x0000000074890000-0x0000000074E41000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe

MD5 db1c31fdb09a47b7215e8869810bec00
SHA1 6c3391975646000d28f4e64a935f738d9d3d62ee
SHA256 0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebe
SHA512 6042ee6b16f7b140460d424d20a9caa95606fcbcab7cb5953c454377e20c0e5ca0f6075f0469ae9a9aa654f48edd85f71b8700f322727c09a1db622d958dfbd5

memory/3540-28-0x0000000000400000-0x000000000046E000-memory.dmp

memory/3540-29-0x0000000000400000-0x000000000046E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holdermail.txt

MD5 e62221a3bb549a72fcc4afa60d34e620
SHA1 d60b16b540e0e3ed459a30cce0678d1fc8a1989a
SHA256 587f8f51485b575f30e5e1608f70b31b9d8bb384318802373cc52cbdf2a4aa95
SHA512 5b6f6a3a88961b62870e486b02e41d065b3f054f3ad45f7c7e01aff3ba151893e36fd3c13771ed9e3738aaa525296a8ee72adc05fb32932ec3af259404172aed

memory/3540-36-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1668-37-0x0000000074890000-0x0000000074E41000-memory.dmp

memory/1352-38-0x0000000074890000-0x0000000074E41000-memory.dmp

memory/2424-39-0x0000000074890000-0x0000000074E41000-memory.dmp

memory/844-40-0x0000000000400000-0x000000000046F000-memory.dmp

memory/844-41-0x0000000000400000-0x000000000046F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\holdermail.txt

MD5 c3609e29395ccd5fd8407fed36414e75
SHA1 04c0c5dc3fcced0c5581c44af17fa60260fb591a
SHA256 a32df1c247d5738af4241edc4aa520dbb21013d05d47cac5db96ccfb48de7857
SHA512 8bbd7b458f2be6e91c46cad8f682e109c7a7317f9ae89e5ce889ae7d4db5775b83d03016f47b56aa75bd5646a50c06ae7adbf2fc8af6b9f8a976f2ce30de3533

memory/844-51-0x0000000000400000-0x000000000046F000-memory.dmp

memory/1668-53-0x0000000074890000-0x0000000074E41000-memory.dmp

memory/2424-55-0x0000000074890000-0x0000000074E41000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\CryptSvc.exe.log

MD5 a5dcc7c9c08af7dddd82be5b036a4416
SHA1 4f998ca1526d199e355ffb435bae111a2779b994
SHA256 e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5
SHA512 56035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a

C:\Users\Admin\AppData\Roaming\pidloc.txt

MD5 03692d53dbd9e60ada8e30719b23eb12
SHA1 3ed8a578da64ef21ce57c103d199bb68e6404430
SHA256 dd7a8568eb52677abdf357f0d93622ab6bc8578dcd87b5af53cb01ae21119d9b
SHA512 8940533e42b1fb1d9f4740c5c2708f6268f4ab708f796f12a2d6547663c64ff23e978fad29d83ea07c23ac3d546023b3cd1b1a9cc61c8145a3fd20f0e0c29f7a

C:\Users\Admin\AppData\Roaming\pid.txt

MD5 8b0dc65f996f98fd178a9defd0efa077
SHA1 fbd5c4e21f715ae152acdd465b3e5bcf3077d0fd
SHA256 9d551151d715267077b3a4a41ac5652b5887a82bd8e5ebdd085386a093cd1a89
SHA512 92ab4a717d505020b29a58c1c86bb4603701342fbb919effdbf703815647d17083f83962718c9fe9a5c9bdbcb7bb3f5ccd417b12c0a5e11fc1682b6dce7a0708

memory/2688-75-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2688-82-0x0000000000400000-0x000000000046E000-memory.dmp

memory/4024-84-0x0000000000400000-0x000000000046F000-memory.dmp

memory/4024-90-0x0000000000470000-0x0000000000539000-memory.dmp

memory/4024-94-0x0000000000400000-0x000000000046F000-memory.dmp