Play interactive tour

Edit tour

Analysis Report mR3CdUkyLL

Overview

General Information

Sample Name:	mR3CdUkyLL (renamed file extension from none to exe)
Analysis ID:	317952
MD5:	eecf912977165e444a64805ec4652e5d
SHA1:	5bdb844b98123e144ec67a4b8c54ce99a66eca1e
SHA256:	c38fcd03c34336492b502735c0704bd4685d33ab29a69358e26ed201254ea63a
Tags:	HawkEye
Most interesting Screenshot:

Detection

HawkEye MailPassView

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected HawkEye Rat

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected HawkEye Keylogger

Yara detected MailPassView

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Changes the view of files in windows explorer (hidden files and folders)

Contains functionality to detect sleep reduction / modifications

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

May check the online IP address of the machine

Sample uses process hollowing technique

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Writes to foreign memory regions

Yara detected WebBrowserPassView password recovery tool

AV process strings found (often used to terminate AV products)

Antivirus or Machine Learning detection for unpacked file

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains strange resources

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores large binary data to the registry

Tries to load missing DLLs

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Startup

System is w10x64

mR3CdUkyLL.exe (PID: 6124 cmdline: 'C:\Users\user\Desktop\mR3CdUkyLL.exe' MD5: EECF912977165E444A64805EC4652E5D)

mR3CdUkyLL.exe (PID: 6092 cmdline: 'C:\Users\user\Desktop\mR3CdUkyLL.exe' MD5: EECF912977165E444A64805EC4652E5D)

dw20.exe (PID: 6168 cmdline: dw20.exe -x -s 2336 MD5: 8D10DA8A3E11747E51F23C882C22BBC3)

vbc.exe (PID: 6248 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)

vbc.exe (PID: 6260 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)

WerFault.exe (PID: 6392 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 2348 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WindowsUpdate.exe (PID: 6500 cmdline: 'C:\Users\user\AppData\Roaming\WindowsUpdate.exe' MD5: EECF912977165E444A64805EC4652E5D)

WindowsUpdate.exe (PID: 6696 cmdline: 'C:\Users\user\AppData\Roaming\WindowsUpdate.exe' MD5: EECF912977165E444A64805EC4652E5D)

WindowsUpdate.exe (PID: 6944 cmdline: 'C:\Users\user\AppData\Roaming\WindowsUpdate.exe' MD5: EECF912977165E444A64805EC4652E5D)

WindowsUpdate.exe (PID: 6960 cmdline: 'C:\Users\user\AppData\Roaming\WindowsUpdate.exe' MD5: EECF912977165E444A64805EC4652E5D)

cleanup

Malware Configuration

Threatname: HawkEye

{"Modules": ["WebBrowserPassView", "mailpv", "Mail PassView"], "Version": ""}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.291517434.0000000003A51000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.291517434.0000000003A51000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000008.00000002.264075129.0000000002A22000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6b7:$key: HawkEyeKeylogger 0x7d905:$salt: 099u787978786 0x7bcf8:$string1: HawkEye_Keylogger 0x7cb37:$string1: HawkEye_Keylogger 0x7d865:$string1: HawkEye_Keylogger 0x7c0cd:$string2: holdermail.txt 0x7c0ed:$string2: holdermail.txt 0x7c00f:$string3: wallet.dat 0x7c027:$string3: wallet.dat 0x7c03d:$string3: wallet.dat 0x7d429:$string4: Keylog Records 0x7d741:$string4: Keylog Records 0x7d95d:$string5: do not script --> 0x7b69f:$string6: \pidloc.txt 0x7b72d:$string7: BSPLIT 0x7b73d:$string7: BSPLIT
00000008.00000002.264075129.0000000002A22000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000008.00000002.264075129.0000000002A22000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000008.00000002.264075129.0000000002A22000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000008.00000002.264075129.0000000002A22000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd50:$hawkstr1: HawkEye Keylogger 0x7cb7d:$hawkstr1: HawkEye Keylogger 0x7ceac:$hawkstr1: HawkEye Keylogger 0x7d007:$hawkstr1: HawkEye Keylogger 0x7d16a:$hawkstr1: HawkEye Keylogger 0x7d401:$hawkstr1: HawkEye Keylogger 0x7b8de:$hawkstr2: Dear HawkEye Customers! 0x7ceff:$hawkstr2: Dear HawkEye Customers! 0x7d056:$hawkstr2: Dear HawkEye Customers! 0x7d1bd:$hawkstr2: Dear HawkEye Customers! 0x7b9ff:$hawkstr3: HawkEye Logger Details:
0000000D.00000002.284301101.0000000000497000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b99f:$key: HawkEyeKeylogger 0x7dbed:$salt: 099u787978786 0x7bfe0:$string1: HawkEye_Keylogger 0x7ce1f:$string1: HawkEye_Keylogger 0x7db4d:$string1: HawkEye_Keylogger 0x7c3b5:$string2: holdermail.txt 0x7c3d5:$string2: holdermail.txt 0x7c2f7:$string3: wallet.dat 0x7c30f:$string3: wallet.dat 0x7c325:$string3: wallet.dat 0x7d711:$string4: Keylog Records 0x7da29:$string4: Keylog Records 0x7dc45:$string5: do not script --> 0x7b987:$string6: \pidloc.txt 0x7ba15:$string7: BSPLIT 0x7ba25:$string7: BSPLIT
0000000D.00000002.284301101.0000000000497000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000D.00000002.284301101.0000000000497000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000000D.00000002.284301101.0000000000497000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000D.00000002.284301101.0000000000497000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c038:$hawkstr1: HawkEye Keylogger 0x7ce65:$hawkstr1: HawkEye Keylogger 0x7d194:$hawkstr1: HawkEye Keylogger 0x7d2ef:$hawkstr1: HawkEye Keylogger 0x7d452:$hawkstr1: HawkEye Keylogger 0x7d6e9:$hawkstr1: HawkEye Keylogger 0x7bbc6:$hawkstr2: Dear HawkEye Customers! 0x7d1e7:$hawkstr2: Dear HawkEye Customers! 0x7d33e:$hawkstr2: Dear HawkEye Customers! 0x7d4a5:$hawkstr2: Dear HawkEye Customers! 0x7bce7:$hawkstr3: HawkEye Logger Details:
00000003.00000002.239397307.0000000000400000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000A.00000002.287705631.0000000000A30000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8b7:$key: HawkEyeKeylogger 0x7db05:$salt: 099u787978786 0x7bef8:$string1: HawkEye_Keylogger 0x7cd37:$string1: HawkEye_Keylogger 0x7da65:$string1: HawkEye_Keylogger 0x7c2cd:$string2: holdermail.txt 0x7c2ed:$string2: holdermail.txt 0x7c20f:$string3: wallet.dat 0x7c227:$string3: wallet.dat 0x7c23d:$string3: wallet.dat 0x7d629:$string4: Keylog Records 0x7d941:$string4: Keylog Records 0x7db5d:$string5: do not script --> 0x7b89f:$string6: \pidloc.txt 0x7b92d:$string7: BSPLIT 0x7b93d:$string7: BSPLIT
0000000A.00000002.287705631.0000000000A30000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000A.00000002.287705631.0000000000A30000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000000A.00000002.287705631.0000000000A30000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000A.00000002.287705631.0000000000A30000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf50:$hawkstr1: HawkEye Keylogger 0x7cd7d:$hawkstr1: HawkEye Keylogger 0x7d0ac:$hawkstr1: HawkEye Keylogger 0x7d207:$hawkstr1: HawkEye Keylogger 0x7d36a:$hawkstr1: HawkEye Keylogger 0x7d601:$hawkstr1: HawkEye Keylogger 0x7bade:$hawkstr2: Dear HawkEye Customers! 0x7d0ff:$hawkstr2: Dear HawkEye Customers! 0x7d256:$hawkstr2: Dear HawkEye Customers! 0x7d3bd:$hawkstr2: Dear HawkEye Customers! 0x7bbff:$hawkstr3: HawkEye Logger Details:
00000001.00000002.285613503.0000000002342000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6b7:$key: HawkEyeKeylogger 0x7d905:$salt: 099u787978786 0x7bcf8:$string1: HawkEye_Keylogger 0x7cb37:$string1: HawkEye_Keylogger 0x7d865:$string1: HawkEye_Keylogger 0x7c0cd:$string2: holdermail.txt 0x7c0ed:$string2: holdermail.txt 0x7c00f:$string3: wallet.dat 0x7c027:$string3: wallet.dat 0x7c03d:$string3: wallet.dat 0x7d429:$string4: Keylog Records 0x7d741:$string4: Keylog Records 0x7d95d:$string5: do not script --> 0x7b69f:$string6: \pidloc.txt 0x7b72d:$string7: BSPLIT 0x7b73d:$string7: BSPLIT
00000001.00000002.285613503.0000000002342000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.285613503.0000000002342000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000002.285613503.0000000002342000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000002.285613503.0000000002342000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd50:$hawkstr1: HawkEye Keylogger 0x7cb7d:$hawkstr1: HawkEye Keylogger 0x7ceac:$hawkstr1: HawkEye Keylogger 0x7d007:$hawkstr1: HawkEye Keylogger 0x7d16a:$hawkstr1: HawkEye Keylogger 0x7d401:$hawkstr1: HawkEye Keylogger 0x7b8de:$hawkstr2: Dear HawkEye Customers! 0x7ceff:$hawkstr2: Dear HawkEye Customers! 0x7d056:$hawkstr2: Dear HawkEye Customers! 0x7d1bd:$hawkstr2: Dear HawkEye Customers! 0x7b9ff:$hawkstr3: HawkEye Logger Details:
0000000A.00000002.290971466.0000000002282000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6b7:$key: HawkEyeKeylogger 0x7d905:$salt: 099u787978786 0x7bcf8:$string1: HawkEye_Keylogger 0x7cb37:$string1: HawkEye_Keylogger 0x7d865:$string1: HawkEye_Keylogger 0x7c0cd:$string2: holdermail.txt 0x7c0ed:$string2: holdermail.txt 0x7c00f:$string3: wallet.dat 0x7c027:$string3: wallet.dat 0x7c03d:$string3: wallet.dat 0x7d429:$string4: Keylog Records 0x7d741:$string4: Keylog Records 0x7d95d:$string5: do not script --> 0x7b69f:$string6: \pidloc.txt 0x7b72d:$string7: BSPLIT 0x7b73d:$string7: BSPLIT
0000000A.00000002.290971466.0000000002282000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000A.00000002.290971466.0000000002282000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000000A.00000002.290971466.0000000002282000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000A.00000002.290971466.0000000002282000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd50:$hawkstr1: HawkEye Keylogger 0x7cb7d:$hawkstr1: HawkEye Keylogger 0x7ceac:$hawkstr1: HawkEye Keylogger 0x7d007:$hawkstr1: HawkEye Keylogger 0x7d16a:$hawkstr1: HawkEye Keylogger 0x7d401:$hawkstr1: HawkEye Keylogger 0x7b8de:$hawkstr2: Dear HawkEye Customers! 0x7ceff:$hawkstr2: Dear HawkEye Customers! 0x7d056:$hawkstr2: Dear HawkEye Customers! 0x7d1bd:$hawkstr2: Dear HawkEye Customers! 0x7b9ff:$hawkstr3: HawkEye Logger Details:
0000000C.00000002.281779218.0000000002A47000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b99f:$key: HawkEyeKeylogger 0x7dbed:$salt: 099u787978786 0x7bfe0:$string1: HawkEye_Keylogger 0x7ce1f:$string1: HawkEye_Keylogger 0x7db4d:$string1: HawkEye_Keylogger 0x7c3b5:$string2: holdermail.txt 0x7c3d5:$string2: holdermail.txt 0x7c2f7:$string3: wallet.dat 0x7c30f:$string3: wallet.dat 0x7c325:$string3: wallet.dat 0x7d711:$string4: Keylog Records 0x7da29:$string4: Keylog Records 0x7dc45:$string5: do not script --> 0x7b987:$string6: \pidloc.txt 0x7ba15:$string7: BSPLIT 0x7ba25:$string7: BSPLIT
0000000C.00000002.281779218.0000000002A47000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000C.00000002.281779218.0000000002A47000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000000C.00000002.281779218.0000000002A47000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000C.00000002.281779218.0000000002A47000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c038:$hawkstr1: HawkEye Keylogger 0x7ce65:$hawkstr1: HawkEye Keylogger 0x7d194:$hawkstr1: HawkEye Keylogger 0x7d2ef:$hawkstr1: HawkEye Keylogger 0x7d452:$hawkstr1: HawkEye Keylogger 0x7d6e9:$hawkstr1: HawkEye Keylogger 0x7bbc6:$hawkstr2: Dear HawkEye Customers! 0x7d1e7:$hawkstr2: Dear HawkEye Customers! 0x7d33e:$hawkstr2: Dear HawkEye Customers! 0x7d4a5:$hawkstr2: Dear HawkEye Customers! 0x7bce7:$hawkstr3: HawkEye Logger Details:
00000001.00000002.285461396.0000000002220000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8b7:$key: HawkEyeKeylogger 0x7db05:$salt: 099u787978786 0x7bef8:$string1: HawkEye_Keylogger 0x7cd37:$string1: HawkEye_Keylogger 0x7da65:$string1: HawkEye_Keylogger 0x7c2cd:$string2: holdermail.txt 0x7c2ed:$string2: holdermail.txt 0x7c20f:$string3: wallet.dat 0x7c227:$string3: wallet.dat 0x7c23d:$string3: wallet.dat 0x7d629:$string4: Keylog Records 0x7d941:$string4: Keylog Records 0x7db5d:$string5: do not script --> 0x7b89f:$string6: \pidloc.txt 0x7b92d:$string7: BSPLIT 0x7b93d:$string7: BSPLIT
00000001.00000002.285461396.0000000002220000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.285461396.0000000002220000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000002.285461396.0000000002220000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000002.285461396.0000000002220000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf50:$hawkstr1: HawkEye Keylogger 0x7cd7d:$hawkstr1: HawkEye Keylogger 0x7d0ac:$hawkstr1: HawkEye Keylogger 0x7d207:$hawkstr1: HawkEye Keylogger 0x7d36a:$hawkstr1: HawkEye Keylogger 0x7d601:$hawkstr1: HawkEye Keylogger 0x7bade:$hawkstr2: Dear HawkEye Customers! 0x7d0ff:$hawkstr2: Dear HawkEye Customers! 0x7d256:$hawkstr2: Dear HawkEye Customers! 0x7d3bd:$hawkstr2: Dear HawkEye Customers! 0x7bbff:$hawkstr3: HawkEye Logger Details:
0000000A.00000002.284300144.0000000000497000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b99f:$key: HawkEyeKeylogger 0x7dbed:$salt: 099u787978786 0x7bfe0:$string1: HawkEye_Keylogger 0x7ce1f:$string1: HawkEye_Keylogger 0x7db4d:$string1: HawkEye_Keylogger 0x7c3b5:$string2: holdermail.txt 0x7c3d5:$string2: holdermail.txt 0x7c2f7:$string3: wallet.dat 0x7c30f:$string3: wallet.dat 0x7c325:$string3: wallet.dat 0x7d711:$string4: Keylog Records 0x7da29:$string4: Keylog Records 0x7dc45:$string5: do not script --> 0x7b987:$string6: \pidloc.txt 0x7ba15:$string7: BSPLIT 0x7ba25:$string7: BSPLIT
0000000A.00000002.284300144.0000000000497000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000A.00000002.284300144.0000000000497000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000000A.00000002.284300144.0000000000497000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000A.00000002.284300144.0000000000497000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c038:$hawkstr1: HawkEye Keylogger 0x7ce65:$hawkstr1: HawkEye Keylogger 0x7d194:$hawkstr1: HawkEye Keylogger 0x7d2ef:$hawkstr1: HawkEye Keylogger 0x7d452:$hawkstr1: HawkEye Keylogger 0x7d6e9:$hawkstr1: HawkEye Keylogger 0x7bbc6:$hawkstr2: Dear HawkEye Customers! 0x7d1e7:$hawkstr2: Dear HawkEye Customers! 0x7d33e:$hawkstr2: Dear HawkEye Customers! 0x7d4a5:$hawkstr2: Dear HawkEye Customers! 0x7bce7:$hawkstr3: HawkEye Logger Details:
00000001.00000002.284328493.0000000000497000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b99f:$key: HawkEyeKeylogger 0x7dbed:$salt: 099u787978786 0x7bfe0:$string1: HawkEye_Keylogger 0x7ce1f:$string1: HawkEye_Keylogger 0x7db4d:$string1: HawkEye_Keylogger 0x7c3b5:$string2: holdermail.txt 0x7c3d5:$string2: holdermail.txt 0x7c2f7:$string3: wallet.dat 0x7c30f:$string3: wallet.dat 0x7c325:$string3: wallet.dat 0x7d711:$string4: Keylog Records 0x7da29:$string4: Keylog Records 0x7dc45:$string5: do not script --> 0x7b987:$string6: \pidloc.txt 0x7ba15:$string7: BSPLIT 0x7ba25:$string7: BSPLIT
00000001.00000002.284328493.0000000000497000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.284328493.0000000000497000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000002.284328493.0000000000497000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000002.284328493.0000000000497000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c038:$hawkstr1: HawkEye Keylogger 0x7ce65:$hawkstr1: HawkEye Keylogger 0x7d194:$hawkstr1: HawkEye Keylogger 0x7d2ef:$hawkstr1: HawkEye Keylogger 0x7d452:$hawkstr1: HawkEye Keylogger 0x7d6e9:$hawkstr1: HawkEye Keylogger 0x7bbc6:$hawkstr2: Dear HawkEye Customers! 0x7d1e7:$hawkstr2: Dear HawkEye Customers! 0x7d33e:$hawkstr2: Dear HawkEye Customers! 0x7d4a5:$hawkstr2: Dear HawkEye Customers! 0x7bce7:$hawkstr3: HawkEye Logger Details:
0000000C.00000002.281646219.00000000029B2000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6b7:$key: HawkEyeKeylogger 0x7d905:$salt: 099u787978786 0x7bcf8:$string1: HawkEye_Keylogger 0x7cb37:$string1: HawkEye_Keylogger 0x7d865:$string1: HawkEye_Keylogger 0x7c0cd:$string2: holdermail.txt 0x7c0ed:$string2: holdermail.txt 0x7c00f:$string3: wallet.dat 0x7c027:$string3: wallet.dat 0x7c03d:$string3: wallet.dat 0x7d429:$string4: Keylog Records 0x7d741:$string4: Keylog Records 0x7d95d:$string5: do not script --> 0x7b69f:$string6: \pidloc.txt 0x7b72d:$string7: BSPLIT 0x7b73d:$string7: BSPLIT
0000000C.00000002.281646219.00000000029B2000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000C.00000002.281646219.00000000029B2000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000000C.00000002.281646219.00000000029B2000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000C.00000002.281646219.00000000029B2000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd50:$hawkstr1: HawkEye Keylogger 0x7cb7d:$hawkstr1: HawkEye Keylogger 0x7ceac:$hawkstr1: HawkEye Keylogger 0x7d007:$hawkstr1: HawkEye Keylogger 0x7d16a:$hawkstr1: HawkEye Keylogger 0x7d401:$hawkstr1: HawkEye Keylogger 0x7b8de:$hawkstr2: Dear HawkEye Customers! 0x7ceff:$hawkstr2: Dear HawkEye Customers! 0x7d056:$hawkstr2: Dear HawkEye Customers! 0x7d1bd:$hawkstr2: Dear HawkEye Customers! 0x7b9ff:$hawkstr3: HawkEye Logger Details:
00000008.00000002.264927894.0000000002AB7000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b99f:$key: HawkEyeKeylogger 0x7dbed:$salt: 099u787978786 0x7bfe0:$string1: HawkEye_Keylogger 0x7ce1f:$string1: HawkEye_Keylogger 0x7db4d:$string1: HawkEye_Keylogger 0x7c3b5:$string2: holdermail.txt 0x7c3d5:$string2: holdermail.txt 0x7c2f7:$string3: wallet.dat 0x7c30f:$string3: wallet.dat 0x7c325:$string3: wallet.dat 0x7d711:$string4: Keylog Records 0x7da29:$string4: Keylog Records 0x7dc45:$string5: do not script --> 0x7b987:$string6: \pidloc.txt 0x7ba15:$string7: BSPLIT 0x7ba25:$string7: BSPLIT
00000008.00000002.264927894.0000000002AB7000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000008.00000002.264927894.0000000002AB7000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000008.00000002.264927894.0000000002AB7000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000008.00000002.264927894.0000000002AB7000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c038:$hawkstr1: HawkEye Keylogger 0x7ce65:$hawkstr1: HawkEye Keylogger 0x7d194:$hawkstr1: HawkEye Keylogger 0x7d2ef:$hawkstr1: HawkEye Keylogger 0x7d452:$hawkstr1: HawkEye Keylogger 0x7d6e9:$hawkstr1: HawkEye Keylogger 0x7bbc6:$hawkstr2: Dear HawkEye Customers! 0x7d1e7:$hawkstr2: Dear HawkEye Customers! 0x7d33e:$hawkstr2: Dear HawkEye Customers! 0x7d4a5:$hawkstr2: Dear HawkEye Customers! 0x7bce7:$hawkstr3: HawkEye Logger Details:
00000001.00000001.214171189.0000000000497000.00000040.00020000.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b99f:$key: HawkEyeKeylogger 0x7dbed:$salt: 099u787978786 0x7bfe0:$string1: HawkEye_Keylogger 0x7ce1f:$string1: HawkEye_Keylogger 0x7db4d:$string1: HawkEye_Keylogger 0x7c3b5:$string2: holdermail.txt 0x7c3d5:$string2: holdermail.txt 0x7c2f7:$string3: wallet.dat 0x7c30f:$string3: wallet.dat 0x7c325:$string3: wallet.dat 0x7d711:$string4: Keylog Records 0x7da29:$string4: Keylog Records 0x7dc45:$string5: do not script --> 0x7b987:$string6: \pidloc.txt 0x7ba15:$string7: BSPLIT 0x7ba25:$string7: BSPLIT
00000001.00000001.214171189.0000000000497000.00000040.00020000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000001.214171189.0000000000497000.00000040.00020000.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000001.214171189.0000000000497000.00000040.00020000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000001.214171189.0000000000497000.00000040.00020000.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c038:$hawkstr1: HawkEye Keylogger 0x7ce65:$hawkstr1: HawkEye Keylogger 0x7d194:$hawkstr1: HawkEye Keylogger 0x7d2ef:$hawkstr1: HawkEye Keylogger 0x7d452:$hawkstr1: HawkEye Keylogger 0x7d6e9:$hawkstr1: HawkEye Keylogger 0x7bbc6:$hawkstr2: Dear HawkEye Customers! 0x7d1e7:$hawkstr2: Dear HawkEye Customers! 0x7d33e:$hawkstr2: Dear HawkEye Customers! 0x7d4a5:$hawkstr2: Dear HawkEye Customers! 0x7bce7:$hawkstr3: HawkEye Logger Details:
0000000D.00000001.279359666.00000000004D2000.00000040.00020000.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x4099f:$key: HawkEyeKeylogger 0x42bed:$salt: 099u787978786 0x40fe0:$string1: HawkEye_Keylogger 0x41e1f:$string1: HawkEye_Keylogger 0x42b4d:$string1: HawkEye_Keylogger 0x413b5:$string2: holdermail.txt 0x413d5:$string2: holdermail.txt 0x412f7:$string3: wallet.dat 0x4130f:$string3: wallet.dat 0x41325:$string3: wallet.dat 0x42711:$string4: Keylog Records 0x42a29:$string4: Keylog Records 0x42c45:$string5: do not script --> 0x40987:$string6: \pidloc.txt 0x40a15:$string7: BSPLIT 0x40a25:$string7: BSPLIT
0000000D.00000001.279359666.00000000004D2000.00000040.00020000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000D.00000001.279359666.00000000004D2000.00000040.00020000.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000000D.00000001.279359666.00000000004D2000.00000040.00020000.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x41038:$hawkstr1: HawkEye Keylogger 0x41e65:$hawkstr1: HawkEye Keylogger 0x42194:$hawkstr1: HawkEye Keylogger 0x422ef:$hawkstr1: HawkEye Keylogger 0x42452:$hawkstr1: HawkEye Keylogger 0x426e9:$hawkstr1: HawkEye Keylogger 0x40bc6:$hawkstr2: Dear HawkEye Customers! 0x421e7:$hawkstr2: Dear HawkEye Customers! 0x4233e:$hawkstr2: Dear HawkEye Customers! 0x424a5:$hawkstr2: Dear HawkEye Customers! 0x40ce7:$hawkstr3: HawkEye Logger Details:
0000000D.00000002.291629122.00000000022F2000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6b7:$key: HawkEyeKeylogger 0x7d905:$salt: 099u787978786 0x7bcf8:$string1: HawkEye_Keylogger 0x7cb37:$string1: HawkEye_Keylogger 0x7d865:$string1: HawkEye_Keylogger 0x7c0cd:$string2: holdermail.txt 0x7c0ed:$string2: holdermail.txt 0x7c00f:$string3: wallet.dat 0x7c027:$string3: wallet.dat 0x7c03d:$string3: wallet.dat 0x7d429:$string4: Keylog Records 0x7d741:$string4: Keylog Records 0x7d95d:$string5: do not script --> 0x7b69f:$string6: \pidloc.txt 0x7b72d:$string7: BSPLIT 0x7b73d:$string7: BSPLIT
0000000D.00000002.291629122.00000000022F2000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000D.00000002.291629122.00000000022F2000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000000D.00000002.291629122.00000000022F2000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000D.00000002.291629122.00000000022F2000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd50:$hawkstr1: HawkEye Keylogger 0x7cb7d:$hawkstr1: HawkEye Keylogger 0x7ceac:$hawkstr1: HawkEye Keylogger 0x7d007:$hawkstr1: HawkEye Keylogger 0x7d16a:$hawkstr1: HawkEye Keylogger 0x7d401:$hawkstr1: HawkEye Keylogger 0x7b8de:$hawkstr2: Dear HawkEye Customers! 0x7ceff:$hawkstr2: Dear HawkEye Customers! 0x7d056:$hawkstr2: Dear HawkEye Customers! 0x7d1bd:$hawkstr2: Dear HawkEye Customers! 0x7b9ff:$hawkstr3: HawkEye Logger Details:
0000000D.00000002.288312296.0000000002262000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6b7:$key: HawkEyeKeylogger 0x7d905:$salt: 099u787978786 0x7bcf8:$string1: HawkEye_Keylogger 0x7cb37:$string1: HawkEye_Keylogger 0x7d865:$string1: HawkEye_Keylogger 0x7c0cd:$string2: holdermail.txt 0x7c0ed:$string2: holdermail.txt 0x7c00f:$string3: wallet.dat 0x7c027:$string3: wallet.dat 0x7c03d:$string3: wallet.dat 0x7d429:$string4: Keylog Records 0x7d741:$string4: Keylog Records 0x7d95d:$string5: do not script --> 0x7b69f:$string6: \pidloc.txt 0x7b72d:$string7: BSPLIT 0x7b73d:$string7: BSPLIT
0000000D.00000002.288312296.0000000002262000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000D.00000002.288312296.0000000002262000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000000D.00000002.288312296.0000000002262000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000D.00000002.288312296.0000000002262000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd50:$hawkstr1: HawkEye Keylogger 0x7cb7d:$hawkstr1: HawkEye Keylogger 0x7ceac:$hawkstr1: HawkEye Keylogger 0x7d007:$hawkstr1: HawkEye Keylogger 0x7d16a:$hawkstr1: HawkEye Keylogger 0x7d401:$hawkstr1: HawkEye Keylogger 0x7b8de:$hawkstr2: Dear HawkEye Customers! 0x7ceff:$hawkstr2: Dear HawkEye Customers! 0x7d056:$hawkstr2: Dear HawkEye Customers! 0x7d1bd:$hawkstr2: Dear HawkEye Customers! 0x7b9ff:$hawkstr3: HawkEye Logger Details:
0000000D.00000002.287562620.00000000009B0000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8b7:$key: HawkEyeKeylogger 0x7db05:$salt: 099u787978786 0x7bef8:$string1: HawkEye_Keylogger 0x7cd37:$string1: HawkEye_Keylogger 0x7da65:$string1: HawkEye_Keylogger 0x7c2cd:$string2: holdermail.txt 0x7c2ed:$string2: holdermail.txt 0x7c20f:$string3: wallet.dat 0x7c227:$string3: wallet.dat 0x7c23d:$string3: wallet.dat 0x7d629:$string4: Keylog Records 0x7d941:$string4: Keylog Records 0x7db5d:$string5: do not script --> 0x7b89f:$string6: \pidloc.txt 0x7b92d:$string7: BSPLIT 0x7b93d:$string7: BSPLIT
0000000D.00000002.287562620.00000000009B0000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000D.00000002.287562620.00000000009B0000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000000D.00000002.287562620.00000000009B0000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000D.00000002.287562620.00000000009B0000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf50:$hawkstr1: HawkEye Keylogger 0x7cd7d:$hawkstr1: HawkEye Keylogger 0x7d0ac:$hawkstr1: HawkEye Keylogger 0x7d207:$hawkstr1: HawkEye Keylogger 0x7d36a:$hawkstr1: HawkEye Keylogger 0x7d601:$hawkstr1: HawkEye Keylogger 0x7bade:$hawkstr2: Dear HawkEye Customers! 0x7d0ff:$hawkstr2: Dear HawkEye Customers! 0x7d256:$hawkstr2: Dear HawkEye Customers! 0x7d3bd:$hawkstr2: Dear HawkEye Customers! 0x7bbff:$hawkstr3: HawkEye Logger Details:
0000000A.00000002.292187107.0000000002362000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6b7:$key: HawkEyeKeylogger 0x7d905:$salt: 099u787978786 0x7bcf8:$string1: HawkEye_Keylogger 0x7cb37:$string1: HawkEye_Keylogger 0x7d865:$string1: HawkEye_Keylogger 0x7c0cd:$string2: holdermail.txt 0x7c0ed:$string2: holdermail.txt 0x7c00f:$string3: wallet.dat 0x7c027:$string3: wallet.dat 0x7c03d:$string3: wallet.dat 0x7d429:$string4: Keylog Records 0x7d741:$string4: Keylog Records 0x7d95d:$string5: do not script --> 0x7b69f:$string6: \pidloc.txt 0x7b72d:$string7: BSPLIT 0x7b73d:$string7: BSPLIT
0000000A.00000002.292187107.0000000002362000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000A.00000002.292187107.0000000002362000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000000A.00000002.292187107.0000000002362000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000A.00000002.292187107.0000000002362000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd50:$hawkstr1: HawkEye Keylogger 0x7cb7d:$hawkstr1: HawkEye Keylogger 0x7ceac:$hawkstr1: HawkEye Keylogger 0x7d007:$hawkstr1: HawkEye Keylogger 0x7d16a:$hawkstr1: HawkEye Keylogger 0x7d401:$hawkstr1: HawkEye Keylogger 0x7b8de:$hawkstr2: Dear HawkEye Customers! 0x7ceff:$hawkstr2: Dear HawkEye Customers! 0x7d056:$hawkstr2: Dear HawkEye Customers! 0x7d1bd:$hawkstr2: Dear HawkEye Customers! 0x7b9ff:$hawkstr3: HawkEye Logger Details:
00000004.00000002.254178019.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000D.00000002.284088931.0000000000402000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6b7:$key: HawkEyeKeylogger 0x7d905:$salt: 099u787978786 0x7bcf8:$string1: HawkEye_Keylogger 0x7cb37:$string1: HawkEye_Keylogger 0x7d865:$string1: HawkEye_Keylogger 0x7c0cd:$string2: holdermail.txt 0x7c0ed:$string2: holdermail.txt 0x7c00f:$string3: wallet.dat 0x7c027:$string3: wallet.dat 0x7c03d:$string3: wallet.dat 0x7d429:$string4: Keylog Records 0x7d741:$string4: Keylog Records 0x7d95d:$string5: do not script --> 0x7b69f:$string6: \pidloc.txt 0x7b72d:$string7: BSPLIT 0x7b73d:$string7: BSPLIT
0000000D.00000002.284088931.0000000000402000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000D.00000002.284088931.0000000000402000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000000D.00000002.284088931.0000000000402000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000D.00000002.284088931.0000000000402000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd50:$hawkstr1: HawkEye Keylogger 0x7cb7d:$hawkstr1: HawkEye Keylogger 0x7ceac:$hawkstr1: HawkEye Keylogger 0x7d007:$hawkstr1: HawkEye Keylogger 0x7d16a:$hawkstr1: HawkEye Keylogger 0x7d401:$hawkstr1: HawkEye Keylogger 0x7b8de:$hawkstr2: Dear HawkEye Customers! 0x7ceff:$hawkstr2: Dear HawkEye Customers! 0x7d056:$hawkstr2: Dear HawkEye Customers! 0x7d1bd:$hawkstr2: Dear HawkEye Customers! 0x7b9ff:$hawkstr3: HawkEye Logger Details:
00000001.00000002.284152713.0000000000402000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6b7:$key: HawkEyeKeylogger 0x7d905:$salt: 099u787978786 0x7bcf8:$string1: HawkEye_Keylogger 0x7cb37:$string1: HawkEye_Keylogger 0x7d865:$string1: HawkEye_Keylogger 0x7c0cd:$string2: holdermail.txt 0x7c0ed:$string2: holdermail.txt 0x7c00f:$string3: wallet.dat 0x7c027:$string3: wallet.dat 0x7c03d:$string3: wallet.dat 0x7d429:$string4: Keylog Records 0x7d741:$string4: Keylog Records 0x7d95d:$string5: do not script --> 0x7b69f:$string6: \pidloc.txt 0x7b72d:$string7: BSPLIT 0x7b73d:$string7: BSPLIT
00000001.00000002.284152713.0000000000402000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.284152713.0000000000402000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000002.284152713.0000000000402000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000002.284152713.0000000000402000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd50:$hawkstr1: HawkEye Keylogger 0x7cb7d:$hawkstr1: HawkEye Keylogger 0x7ceac:$hawkstr1: HawkEye Keylogger 0x7d007:$hawkstr1: HawkEye Keylogger 0x7d16a:$hawkstr1: HawkEye Keylogger 0x7d401:$hawkstr1: HawkEye Keylogger 0x7b8de:$hawkstr2: Dear HawkEye Customers! 0x7ceff:$hawkstr2: Dear HawkEye Customers! 0x7d056:$hawkstr2: Dear HawkEye Customers! 0x7d1bd:$hawkstr2: Dear HawkEye Customers! 0x7b9ff:$hawkstr3: HawkEye Logger Details:
00000001.00000002.285532239.00000000022B2000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6b7:$key: HawkEyeKeylogger 0x7d905:$salt: 099u787978786 0x7bcf8:$string1: HawkEye_Keylogger 0x7cb37:$string1: HawkEye_Keylogger 0x7d865:$string1: HawkEye_Keylogger 0x7c0cd:$string2: holdermail.txt 0x7c0ed:$string2: holdermail.txt 0x7c00f:$string3: wallet.dat 0x7c027:$string3: wallet.dat 0x7c03d:$string3: wallet.dat 0x7d429:$string4: Keylog Records 0x7d741:$string4: Keylog Records 0x7d95d:$string5: do not script --> 0x7b69f:$string6: \pidloc.txt 0x7b72d:$string7: BSPLIT 0x7b73d:$string7: BSPLIT
00000001.00000002.285532239.00000000022B2000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.285532239.00000000022B2000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000002.285532239.00000000022B2000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000002.285532239.00000000022B2000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd50:$hawkstr1: HawkEye Keylogger 0x7cb7d:$hawkstr1: HawkEye Keylogger 0x7ceac:$hawkstr1: HawkEye Keylogger 0x7d007:$hawkstr1: HawkEye Keylogger 0x7d16a:$hawkstr1: HawkEye Keylogger 0x7d401:$hawkstr1: HawkEye Keylogger 0x7b8de:$hawkstr2: Dear HawkEye Customers! 0x7ceff:$hawkstr2: Dear HawkEye Customers! 0x7d056:$hawkstr2: Dear HawkEye Customers! 0x7d1bd:$hawkstr2: Dear HawkEye Customers! 0x7b9ff:$hawkstr3: HawkEye Logger Details:
0000000A.00000002.284081109.0000000000402000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6b7:$key: HawkEyeKeylogger 0x7d905:$salt: 099u787978786 0x7bcf8:$string1: HawkEye_Keylogger 0x7cb37:$string1: HawkEye_Keylogger 0x7d865:$string1: HawkEye_Keylogger 0x7c0cd:$string2: holdermail.txt 0x7c0ed:$string2: holdermail.txt 0x7c00f:$string3: wallet.dat 0x7c027:$string3: wallet.dat 0x7c03d:$string3: wallet.dat 0x7d429:$string4: Keylog Records 0x7d741:$string4: Keylog Records 0x7d95d:$string5: do not script --> 0x7b69f:$string6: \pidloc.txt 0x7b72d:$string7: BSPLIT 0x7b73d:$string7: BSPLIT
0000000A.00000002.284081109.0000000000402000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000A.00000002.284081109.0000000000402000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000000A.00000002.284081109.0000000000402000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000A.00000002.284081109.0000000000402000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd50:$hawkstr1: HawkEye Keylogger 0x7cb7d:$hawkstr1: HawkEye Keylogger 0x7ceac:$hawkstr1: HawkEye Keylogger 0x7d007:$hawkstr1: HawkEye Keylogger 0x7d16a:$hawkstr1: HawkEye Keylogger 0x7d401:$hawkstr1: HawkEye Keylogger 0x7b8de:$hawkstr2: Dear HawkEye Customers! 0x7ceff:$hawkstr2: Dear HawkEye Customers! 0x7d056:$hawkstr2: Dear HawkEye Customers! 0x7d1bd:$hawkstr2: Dear HawkEye Customers! 0x7b9ff:$hawkstr3: HawkEye Logger Details:
00000000.00000002.215270566.0000000002A12000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6b7:$key: HawkEyeKeylogger 0x7d905:$salt: 099u787978786 0x7bcf8:$string1: HawkEye_Keylogger 0x7cb37:$string1: HawkEye_Keylogger 0x7d865:$string1: HawkEye_Keylogger 0x7c0cd:$string2: holdermail.txt 0x7c0ed:$string2: holdermail.txt 0x7c00f:$string3: wallet.dat 0x7c027:$string3: wallet.dat 0x7c03d:$string3: wallet.dat 0x7d429:$string4: Keylog Records 0x7d741:$string4: Keylog Records 0x7d95d:$string5: do not script --> 0x7b69f:$string6: \pidloc.txt 0x7b72d:$string7: BSPLIT 0x7b73d:$string7: BSPLIT
00000000.00000002.215270566.0000000002A12000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000000.00000002.215270566.0000000002A12000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000000.00000002.215270566.0000000002A12000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000000.00000002.215270566.0000000002A12000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd50:$hawkstr1: HawkEye Keylogger 0x7cb7d:$hawkstr1: HawkEye Keylogger 0x7ceac:$hawkstr1: HawkEye Keylogger 0x7d007:$hawkstr1: HawkEye Keylogger 0x7d16a:$hawkstr1: HawkEye Keylogger 0x7d401:$hawkstr1: HawkEye Keylogger 0x7b8de:$hawkstr2: Dear HawkEye Customers! 0x7ceff:$hawkstr2: Dear HawkEye Customers! 0x7d056:$hawkstr2: Dear HawkEye Customers! 0x7d1bd:$hawkstr2: Dear HawkEye Customers! 0x7b9ff:$hawkstr3: HawkEye Logger Details:
00000000.00000002.215363320.0000000002AA7000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b99f:$key: HawkEyeKeylogger 0x7dbed:$salt: 099u787978786 0x7bfe0:$string1: HawkEye_Keylogger 0x7ce1f:$string1: HawkEye_Keylogger 0x7db4d:$string1: HawkEye_Keylogger 0x7c3b5:$string2: holdermail.txt 0x7c3d5:$string2: holdermail.txt 0x7c2f7:$string3: wallet.dat 0x7c30f:$string3: wallet.dat 0x7c325:$string3: wallet.dat 0x7d711:$string4: Keylog Records 0x7da29:$string4: Keylog Records 0x7dc45:$string5: do not script --> 0x7b987:$string6: \pidloc.txt 0x7ba15:$string7: BSPLIT 0x7ba25:$string7: BSPLIT
00000000.00000002.215363320.0000000002AA7000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000000.00000002.215363320.0000000002AA7000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000000.00000002.215363320.0000000002AA7000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000000.00000002.215363320.0000000002AA7000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c038:$hawkstr1: HawkEye Keylogger 0x7ce65:$hawkstr1: HawkEye Keylogger 0x7d194:$hawkstr1: HawkEye Keylogger 0x7d2ef:$hawkstr1: HawkEye Keylogger 0x7d452:$hawkstr1: HawkEye Keylogger 0x7d6e9:$hawkstr1: HawkEye Keylogger 0x7bbc6:$hawkstr2: Dear HawkEye Customers! 0x7d1e7:$hawkstr2: Dear HawkEye Customers! 0x7d33e:$hawkstr2: Dear HawkEye Customers! 0x7d4a5:$hawkstr2: Dear HawkEye Customers! 0x7bce7:$hawkstr3: HawkEye Logger Details:
00000001.00000002.287736407.0000000002A51000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x2cf38:$key: HawkEyeKeylogger 0x2d588:$salt: 099u787978786 0x43728:$string1: HawkEye_Keylogger 0x498f4:$string1: HawkEye_Keylogger 0x47278:$string2: holdermail.txt 0x472a8:$string2: holdermail.txt 0x442b6:$string3: wallet.dat 0x442de:$string3: wallet.dat 0x44304:$string3: wallet.dat 0x45b2c:$string4: Keylog Records 0x45e62:$string4: Keylog Records 0x31c08:$string5: do not script --> 0x2cf10:$string6: \pidloc.txt 0x2d018:$string7: BSPLIT 0x2d038:$string7: BSPLIT
00000001.00000002.287736407.0000000002A51000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000002.287736407.0000000002A51000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x437b8:$hawkstr1: HawkEye Keylogger 0x44574:$hawkstr1: HawkEye Keylogger 0x4490c:$hawkstr1: HawkEye Keylogger 0x45b04:$hawkstr1: HawkEye Keylogger 0x4994c:$hawkstr1: HawkEye Keylogger 0xdbd04:$hawkstr1: HawkEye Keylogger 0x43230:$hawkstr2: Dear HawkEye Customers! 0x445d8:$hawkstr2: Dear HawkEye Customers! 0x44970:$hawkstr2: Dear HawkEye Customers! 0xdbd64:$hawkstr2: Dear HawkEye Customers! 0x43362:$hawkstr3: HawkEye Logger Details:
Process Memory Space: mR3CdUkyLL.exe PID: 6092	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: mR3CdUkyLL.exe PID: 6092	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: mR3CdUkyLL.exe PID: 6092	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: mR3CdUkyLL.exe PID: 6092	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: WindowsUpdate.exe PID: 6960	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: WindowsUpdate.exe PID: 6960	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: WindowsUpdate.exe PID: 6960	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: WindowsUpdate.exe PID: 6960	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: mR3CdUkyLL.exe PID: 6124	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: mR3CdUkyLL.exe PID: 6124	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: mR3CdUkyLL.exe PID: 6124	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: mR3CdUkyLL.exe PID: 6124	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: vbc.exe PID: 6260	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: WindowsUpdate.exe PID: 6696	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: WindowsUpdate.exe PID: 6696	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: WindowsUpdate.exe PID: 6696	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: WindowsUpdate.exe PID: 6696	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: vbc.exe PID: 6248	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: WindowsUpdate.exe PID: 6500	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: WindowsUpdate.exe PID: 6500	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: WindowsUpdate.exe PID: 6500	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: WindowsUpdate.exe PID: 6500	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: WindowsUpdate.exe PID: 6944	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: WindowsUpdate.exe PID: 6944	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: WindowsUpdate.exe PID: 6944	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: WindowsUpdate.exe PID: 6944	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Click to see the 142 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.mR3CdUkyLL.exe.2220000.1.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x79ab7:$key: HawkEyeKeylogger 0x7bd05:$salt: 099u787978786 0x7a0f8:$string1: HawkEye_Keylogger 0x7af37:$string1: HawkEye_Keylogger 0x7bc65:$string1: HawkEye_Keylogger 0x7a4cd:$string2: holdermail.txt 0x7a4ed:$string2: holdermail.txt 0x7a40f:$string3: wallet.dat 0x7a427:$string3: wallet.dat 0x7a43d:$string3: wallet.dat 0x7b829:$string4: Keylog Records 0x7bb41:$string4: Keylog Records 0x7bd5d:$string5: do not script --> 0x79a9f:$string6: \pidloc.txt 0x79b2d:$string7: BSPLIT 0x79b3d:$string7: BSPLIT
1.2.mR3CdUkyLL.exe.2220000.1.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.mR3CdUkyLL.exe.2220000.1.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.mR3CdUkyLL.exe.2220000.1.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.mR3CdUkyLL.exe.2220000.1.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7a150:$hawkstr1: HawkEye Keylogger 0x7af7d:$hawkstr1: HawkEye Keylogger 0x7b2ac:$hawkstr1: HawkEye Keylogger 0x7b407:$hawkstr1: HawkEye Keylogger 0x7b56a:$hawkstr1: HawkEye Keylogger 0x7b801:$hawkstr1: HawkEye Keylogger 0x79cde:$hawkstr2: Dear HawkEye Customers! 0x7b2ff:$hawkstr2: Dear HawkEye Customers! 0x7b456:$hawkstr2: Dear HawkEye Customers! 0x7b5bd:$hawkstr2: Dear HawkEye Customers! 0x79dff:$hawkstr3: HawkEye Logger Details:
3.2.vbc.exe.400000.0.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
3.2.vbc.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.2.mR3CdUkyLL.exe.29c0000.2.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0xcd6b7:$key: HawkEyeKeylogger 0xcf905:$salt: 099u787978786 0xcdcf8:$string1: HawkEye_Keylogger 0xceb37:$string1: HawkEye_Keylogger 0xcf865:$string1: HawkEye_Keylogger 0xce0cd:$string2: holdermail.txt 0xce0ed:$string2: holdermail.txt 0xce00f:$string3: wallet.dat 0xce027:$string3: wallet.dat 0xce03d:$string3: wallet.dat 0xcf429:$string4: Keylog Records 0xcf741:$string4: Keylog Records 0xcf95d:$string5: do not script --> 0xcd69f:$string6: \pidloc.txt 0xcd72d:$string7: BSPLIT 0xcd73d:$string7: BSPLIT
0.2.mR3CdUkyLL.exe.29c0000.2.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.2.mR3CdUkyLL.exe.29c0000.2.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.2.mR3CdUkyLL.exe.29c0000.2.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.2.mR3CdUkyLL.exe.29c0000.2.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0xcdd50:$hawkstr1: HawkEye Keylogger 0xceb7d:$hawkstr1: HawkEye Keylogger 0xceeac:$hawkstr1: HawkEye Keylogger 0xcf007:$hawkstr1: HawkEye Keylogger 0xcf16a:$hawkstr1: HawkEye Keylogger 0xcf401:$hawkstr1: HawkEye Keylogger 0xcd8de:$hawkstr2: Dear HawkEye Customers! 0xceeff:$hawkstr2: Dear HawkEye Customers! 0xcf056:$hawkstr2: Dear HawkEye Customers! 0xcf1bd:$hawkstr2: Dear HawkEye Customers! 0xcd9ff:$hawkstr3: HawkEye Logger Details:
10.2.WindowsUpdate.exe.a30000.1.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8b7:$key: HawkEyeKeylogger 0x7db05:$salt: 099u787978786 0x7bef8:$string1: HawkEye_Keylogger 0x7cd37:$string1: HawkEye_Keylogger 0x7da65:$string1: HawkEye_Keylogger 0x7c2cd:$string2: holdermail.txt 0x7c2ed:$string2: holdermail.txt 0x7c20f:$string3: wallet.dat 0x7c227:$string3: wallet.dat 0x7c23d:$string3: wallet.dat 0x7d629:$string4: Keylog Records 0x7d941:$string4: Keylog Records 0x7db5d:$string5: do not script --> 0x7b89f:$string6: \pidloc.txt 0x7b92d:$string7: BSPLIT 0x7b93d:$string7: BSPLIT
10.2.WindowsUpdate.exe.a30000.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
10.2.WindowsUpdate.exe.a30000.1.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
10.2.WindowsUpdate.exe.a30000.1.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
10.2.WindowsUpdate.exe.a30000.1.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf50:$hawkstr1: HawkEye Keylogger 0x7cd7d:$hawkstr1: HawkEye Keylogger 0x7d0ac:$hawkstr1: HawkEye Keylogger 0x7d207:$hawkstr1: HawkEye Keylogger 0x7d36a:$hawkstr1: HawkEye Keylogger 0x7d601:$hawkstr1: HawkEye Keylogger 0x7bade:$hawkstr2: Dear HawkEye Customers! 0x7d0ff:$hawkstr2: Dear HawkEye Customers! 0x7d256:$hawkstr2: Dear HawkEye Customers! 0x7d3bd:$hawkstr2: Dear HawkEye Customers! 0x7bbff:$hawkstr3: HawkEye Logger Details:
13.1.WindowsUpdate.exe.400000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x11299f:$key: HawkEyeKeylogger 0x114bed:$salt: 099u787978786 0x112fe0:$string1: HawkEye_Keylogger 0x113e1f:$string1: HawkEye_Keylogger 0x114b4d:$string1: HawkEye_Keylogger 0x1133b5:$string2: holdermail.txt 0x1133d5:$string2: holdermail.txt 0x1132f7:$string3: wallet.dat 0x11330f:$string3: wallet.dat 0x113325:$string3: wallet.dat 0x114711:$string4: Keylog Records 0x114a29:$string4: Keylog Records 0x114c45:$string5: do not script --> 0x112987:$string6: \pidloc.txt 0x112a15:$string7: BSPLIT 0x112a25:$string7: BSPLIT
13.1.WindowsUpdate.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
13.1.WindowsUpdate.exe.400000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
13.1.WindowsUpdate.exe.400000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x113038:$hawkstr1: HawkEye Keylogger 0x113e65:$hawkstr1: HawkEye Keylogger 0x114194:$hawkstr1: HawkEye Keylogger 0x1142ef:$hawkstr1: HawkEye Keylogger 0x114452:$hawkstr1: HawkEye Keylogger 0x1146e9:$hawkstr1: HawkEye Keylogger 0x112bc6:$hawkstr2: Dear HawkEye Customers! 0x1141e7:$hawkstr2: Dear HawkEye Customers! 0x11433e:$hawkstr2: Dear HawkEye Customers! 0x1144a5:$hawkstr2: Dear HawkEye Customers! 0x112ce7:$hawkstr3: HawkEye Logger Details:
1.2.mR3CdUkyLL.exe.2220000.1.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8b7:$key: HawkEyeKeylogger 0x7db05:$salt: 099u787978786 0x7bef8:$string1: HawkEye_Keylogger 0x7cd37:$string1: HawkEye_Keylogger 0x7da65:$string1: HawkEye_Keylogger 0x7c2cd:$string2: holdermail.txt 0x7c2ed:$string2: holdermail.txt 0x7c20f:$string3: wallet.dat 0x7c227:$string3: wallet.dat 0x7c23d:$string3: wallet.dat 0x7d629:$string4: Keylog Records 0x7d941:$string4: Keylog Records 0x7db5d:$string5: do not script --> 0x7b89f:$string6: \pidloc.txt 0x7b92d:$string7: BSPLIT 0x7b93d:$string7: BSPLIT
1.2.mR3CdUkyLL.exe.2220000.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.mR3CdUkyLL.exe.2220000.1.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.mR3CdUkyLL.exe.2220000.1.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.mR3CdUkyLL.exe.2220000.1.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf50:$hawkstr1: HawkEye Keylogger 0x7cd7d:$hawkstr1: HawkEye Keylogger 0x7d0ac:$hawkstr1: HawkEye Keylogger 0x7d207:$hawkstr1: HawkEye Keylogger 0x7d36a:$hawkstr1: HawkEye Keylogger 0x7d601:$hawkstr1: HawkEye Keylogger 0x7bade:$hawkstr2: Dear HawkEye Customers! 0x7d0ff:$hawkstr2: Dear HawkEye Customers! 0x7d256:$hawkstr2: Dear HawkEye Customers! 0x7d3bd:$hawkstr2: Dear HawkEye Customers! 0x7bbff:$hawkstr3: HawkEye Logger Details:
13.2.WindowsUpdate.exe.9b0000.1.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x79ab7:$key: HawkEyeKeylogger 0x7bd05:$salt: 099u787978786 0x7a0f8:$string1: HawkEye_Keylogger 0x7af37:$string1: HawkEye_Keylogger 0x7bc65:$string1: HawkEye_Keylogger 0x7a4cd:$string2: holdermail.txt 0x7a4ed:$string2: holdermail.txt 0x7a40f:$string3: wallet.dat 0x7a427:$string3: wallet.dat 0x7a43d:$string3: wallet.dat 0x7b829:$string4: Keylog Records 0x7bb41:$string4: Keylog Records 0x7bd5d:$string5: do not script --> 0x79a9f:$string6: \pidloc.txt 0x79b2d:$string7: BSPLIT 0x79b3d:$string7: BSPLIT
13.2.WindowsUpdate.exe.9b0000.1.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
13.2.WindowsUpdate.exe.9b0000.1.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
13.2.WindowsUpdate.exe.9b0000.1.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
13.2.WindowsUpdate.exe.9b0000.1.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7a150:$hawkstr1: HawkEye Keylogger 0x7af7d:$hawkstr1: HawkEye Keylogger 0x7b2ac:$hawkstr1: HawkEye Keylogger 0x7b407:$hawkstr1: HawkEye Keylogger 0x7b56a:$hawkstr1: HawkEye Keylogger 0x7b801:$hawkstr1: HawkEye Keylogger 0x79cde:$hawkstr2: Dear HawkEye Customers! 0x7b2ff:$hawkstr2: Dear HawkEye Customers! 0x7b456:$hawkstr2: Dear HawkEye Customers! 0x7b5bd:$hawkstr2: Dear HawkEye Customers! 0x79dff:$hawkstr3: HawkEye Logger Details:
1.2.mR3CdUkyLL.exe.2340000.3.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8b7:$key: HawkEyeKeylogger 0x7db05:$salt: 099u787978786 0x7bef8:$string1: HawkEye_Keylogger 0x7cd37:$string1: HawkEye_Keylogger 0x7da65:$string1: HawkEye_Keylogger 0x7c2cd:$string2: holdermail.txt 0x7c2ed:$string2: holdermail.txt 0x7c20f:$string3: wallet.dat 0x7c227:$string3: wallet.dat 0x7c23d:$string3: wallet.dat 0x7d629:$string4: Keylog Records 0x7d941:$string4: Keylog Records 0x7db5d:$string5: do not script --> 0x7b89f:$string6: \pidloc.txt 0x7b92d:$string7: BSPLIT 0x7b93d:$string7: BSPLIT
1.2.mR3CdUkyLL.exe.2340000.3.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.mR3CdUkyLL.exe.2340000.3.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.mR3CdUkyLL.exe.2340000.3.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.mR3CdUkyLL.exe.2340000.3.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf50:$hawkstr1: HawkEye Keylogger 0x7cd7d:$hawkstr1: HawkEye Keylogger 0x7d0ac:$hawkstr1: HawkEye Keylogger 0x7d207:$hawkstr1: HawkEye Keylogger 0x7d36a:$hawkstr1: HawkEye Keylogger 0x7d601:$hawkstr1: HawkEye Keylogger 0x7bade:$hawkstr2: Dear HawkEye Customers! 0x7d0ff:$hawkstr2: Dear HawkEye Customers! 0x7d256:$hawkstr2: Dear HawkEye Customers! 0x7d3bd:$hawkstr2: Dear HawkEye Customers! 0x7bbff:$hawkstr3: HawkEye Logger Details:
10.2.WindowsUpdate.exe.a30000.1.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x79ab7:$key: HawkEyeKeylogger 0x7bd05:$salt: 099u787978786 0x7a0f8:$string1: HawkEye_Keylogger 0x7af37:$string1: HawkEye_Keylogger 0x7bc65:$string1: HawkEye_Keylogger 0x7a4cd:$string2: holdermail.txt 0x7a4ed:$string2: holdermail.txt 0x7a40f:$string3: wallet.dat 0x7a427:$string3: wallet.dat 0x7a43d:$string3: wallet.dat 0x7b829:$string4: Keylog Records 0x7bb41:$string4: Keylog Records 0x7bd5d:$string5: do not script --> 0x79a9f:$string6: \pidloc.txt 0x79b2d:$string7: BSPLIT 0x79b3d:$string7: BSPLIT
10.2.WindowsUpdate.exe.a30000.1.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
10.2.WindowsUpdate.exe.a30000.1.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
10.2.WindowsUpdate.exe.a30000.1.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
10.2.WindowsUpdate.exe.a30000.1.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7a150:$hawkstr1: HawkEye Keylogger 0x7af7d:$hawkstr1: HawkEye Keylogger 0x7b2ac:$hawkstr1: HawkEye Keylogger 0x7b407:$hawkstr1: HawkEye Keylogger 0x7b56a:$hawkstr1: HawkEye Keylogger 0x7b801:$hawkstr1: HawkEye Keylogger 0x79cde:$hawkstr2: Dear HawkEye Customers! 0x7b2ff:$hawkstr2: Dear HawkEye Customers! 0x7b456:$hawkstr2: Dear HawkEye Customers! 0x7b5bd:$hawkstr2: Dear HawkEye Customers! 0x79dff:$hawkstr3: HawkEye Logger Details:
10.2.WindowsUpdate.exe.2360000.3.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8b7:$key: HawkEyeKeylogger 0x7db05:$salt: 099u787978786 0x7bef8:$string1: HawkEye_Keylogger 0x7cd37:$string1: HawkEye_Keylogger 0x7da65:$string1: HawkEye_Keylogger 0x7c2cd:$string2: holdermail.txt 0x7c2ed:$string2: holdermail.txt 0x7c20f:$string3: wallet.dat 0x7c227:$string3: wallet.dat 0x7c23d:$string3: wallet.dat 0x7d629:$string4: Keylog Records 0x7d941:$string4: Keylog Records 0x7db5d:$string5: do not script --> 0x7b89f:$string6: \pidloc.txt 0x7b92d:$string7: BSPLIT 0x7b93d:$string7: BSPLIT
10.2.WindowsUpdate.exe.2360000.3.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
10.2.WindowsUpdate.exe.2360000.3.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
10.2.WindowsUpdate.exe.2360000.3.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
10.2.WindowsUpdate.exe.2360000.3.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf50:$hawkstr1: HawkEye Keylogger 0x7cd7d:$hawkstr1: HawkEye Keylogger 0x7d0ac:$hawkstr1: HawkEye Keylogger 0x7d207:$hawkstr1: HawkEye Keylogger 0x7d36a:$hawkstr1: HawkEye Keylogger 0x7d601:$hawkstr1: HawkEye Keylogger 0x7bade:$hawkstr2: Dear HawkEye Customers! 0x7d0ff:$hawkstr2: Dear HawkEye Customers! 0x7d256:$hawkstr2: Dear HawkEye Customers! 0x7d3bd:$hawkstr2: Dear HawkEye Customers! 0x7bbff:$hawkstr3: HawkEye Logger Details:
0.2.mR3CdUkyLL.exe.2a10000.3.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x47b6b7:$key: HawkEyeKeylogger 0x47d905:$salt: 099u787978786 0x47bcf8:$string1: HawkEye_Keylogger 0x47cb37:$string1: HawkEye_Keylogger 0x47d865:$string1: HawkEye_Keylogger 0x47c0cd:$string2: holdermail.txt 0x47c0ed:$string2: holdermail.txt 0x47c00f:$string3: wallet.dat 0x47c027:$string3: wallet.dat 0x47c03d:$string3: wallet.dat 0x47d429:$string4: Keylog Records 0x47d741:$string4: Keylog Records 0x47d95d:$string5: do not script --> 0x47b69f:$string6: \pidloc.txt 0x47b72d:$string7: BSPLIT 0x47b73d:$string7: BSPLIT
0.2.mR3CdUkyLL.exe.2a10000.3.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.2.mR3CdUkyLL.exe.2a10000.3.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.2.mR3CdUkyLL.exe.2a10000.3.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.2.mR3CdUkyLL.exe.2a10000.3.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x47bd50:$hawkstr1: HawkEye Keylogger 0x47cb7d:$hawkstr1: HawkEye Keylogger 0x47ceac:$hawkstr1: HawkEye Keylogger 0x47d007:$hawkstr1: HawkEye Keylogger 0x47d16a:$hawkstr1: HawkEye Keylogger 0x47d401:$hawkstr1: HawkEye Keylogger 0x47b8de:$hawkstr2: Dear HawkEye Customers! 0x47ceff:$hawkstr2: Dear HawkEye Customers! 0x47d056:$hawkstr2: Dear HawkEye Customers! 0x47d1bd:$hawkstr2: Dear HawkEye Customers! 0x47b9ff:$hawkstr3: HawkEye Logger Details:
4.2.vbc.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
13.2.WindowsUpdate.exe.2260000.2.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x47b6b7:$key: HawkEyeKeylogger 0x47d905:$salt: 099u787978786 0x47bcf8:$string1: HawkEye_Keylogger 0x47cb37:$string1: HawkEye_Keylogger 0x47d865:$string1: HawkEye_Keylogger 0x47c0cd:$string2: holdermail.txt 0x47c0ed:$string2: holdermail.txt 0x47c00f:$string3: wallet.dat 0x47c027:$string3: wallet.dat 0x47c03d:$string3: wallet.dat 0x47d429:$string4: Keylog Records 0x47d741:$string4: Keylog Records 0x47d95d:$string5: do not script --> 0x47b69f:$string6: \pidloc.txt 0x47b72d:$string7: BSPLIT 0x47b73d:$string7: BSPLIT
13.2.WindowsUpdate.exe.2260000.2.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
13.2.WindowsUpdate.exe.2260000.2.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
13.2.WindowsUpdate.exe.2260000.2.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
13.2.WindowsUpdate.exe.2260000.2.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x47bd50:$hawkstr1: HawkEye Keylogger 0x47cb7d:$hawkstr1: HawkEye Keylogger 0x47ceac:$hawkstr1: HawkEye Keylogger 0x47d007:$hawkstr1: HawkEye Keylogger 0x47d16a:$hawkstr1: HawkEye Keylogger 0x47d401:$hawkstr1: HawkEye Keylogger 0x47b8de:$hawkstr2: Dear HawkEye Customers! 0x47ceff:$hawkstr2: Dear HawkEye Customers! 0x47d056:$hawkstr2: Dear HawkEye Customers! 0x47d1bd:$hawkstr2: Dear HawkEye Customers! 0x47b9ff:$hawkstr3: HawkEye Logger Details:
1.1.mR3CdUkyLL.exe.400000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x11299f:$key: HawkEyeKeylogger 0x114bed:$salt: 099u787978786 0x112fe0:$string1: HawkEye_Keylogger 0x113e1f:$string1: HawkEye_Keylogger 0x114b4d:$string1: HawkEye_Keylogger 0x1133b5:$string2: holdermail.txt 0x1133d5:$string2: holdermail.txt 0x1132f7:$string3: wallet.dat 0x11330f:$string3: wallet.dat 0x113325:$string3: wallet.dat 0x114711:$string4: Keylog Records 0x114a29:$string4: Keylog Records 0x114c45:$string5: do not script --> 0x112987:$string6: \pidloc.txt 0x112a15:$string7: BSPLIT 0x112a25:$string7: BSPLIT
1.1.mR3CdUkyLL.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.1.mR3CdUkyLL.exe.400000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.1.mR3CdUkyLL.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.1.mR3CdUkyLL.exe.400000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x113038:$hawkstr1: HawkEye Keylogger 0x113e65:$hawkstr1: HawkEye Keylogger 0x114194:$hawkstr1: HawkEye Keylogger 0x1142ef:$hawkstr1: HawkEye Keylogger 0x114452:$hawkstr1: HawkEye Keylogger 0x1146e9:$hawkstr1: HawkEye Keylogger 0x112bc6:$hawkstr2: Dear HawkEye Customers! 0x1141e7:$hawkstr2: Dear HawkEye Customers! 0x11433e:$hawkstr2: Dear HawkEye Customers! 0x1144a5:$hawkstr2: Dear HawkEye Customers! 0x112ce7:$hawkstr3: HawkEye Logger Details:
4.2.vbc.exe.400000.0.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.mR3CdUkyLL.exe.22b0000.2.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x47b6b7:$key: HawkEyeKeylogger 0x47d905:$salt: 099u787978786 0x47bcf8:$string1: HawkEye_Keylogger 0x47cb37:$string1: HawkEye_Keylogger 0x47d865:$string1: HawkEye_Keylogger 0x47c0cd:$string2: holdermail.txt 0x47c0ed:$string2: holdermail.txt 0x47c00f:$string3: wallet.dat 0x47c027:$string3: wallet.dat 0x47c03d:$string3: wallet.dat 0x47d429:$string4: Keylog Records 0x47d741:$string4: Keylog Records 0x47d95d:$string5: do not script --> 0x47b69f:$string6: \pidloc.txt 0x47b72d:$string7: BSPLIT 0x47b73d:$string7: BSPLIT
1.2.mR3CdUkyLL.exe.22b0000.2.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.mR3CdUkyLL.exe.22b0000.2.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.mR3CdUkyLL.exe.22b0000.2.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.mR3CdUkyLL.exe.22b0000.2.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x47bd50:$hawkstr1: HawkEye Keylogger 0x47cb7d:$hawkstr1: HawkEye Keylogger 0x47ceac:$hawkstr1: HawkEye Keylogger 0x47d007:$hawkstr1: HawkEye Keylogger 0x47d16a:$hawkstr1: HawkEye Keylogger 0x47d401:$hawkstr1: HawkEye Keylogger 0x47b8de:$hawkstr2: Dear HawkEye Customers! 0x47ceff:$hawkstr2: Dear HawkEye Customers! 0x47d056:$hawkstr2: Dear HawkEye Customers! 0x47d1bd:$hawkstr2: Dear HawkEye Customers! 0x47b9ff:$hawkstr3: HawkEye Logger Details:
8.2.WindowsUpdate.exe.2a20000.3.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x47b6b7:$key: HawkEyeKeylogger 0x47d905:$salt: 099u787978786 0x47bcf8:$string1: HawkEye_Keylogger 0x47cb37:$string1: HawkEye_Keylogger 0x47d865:$string1: HawkEye_Keylogger 0x47c0cd:$string2: holdermail.txt 0x47c0ed:$string2: holdermail.txt 0x47c00f:$string3: wallet.dat 0x47c027:$string3: wallet.dat 0x47c03d:$string3: wallet.dat 0x47d429:$string4: Keylog Records 0x47d741:$string4: Keylog Records 0x47d95d:$string5: do not script --> 0x47b69f:$string6: \pidloc.txt 0x47b72d:$string7: BSPLIT 0x47b73d:$string7: BSPLIT
8.2.WindowsUpdate.exe.2a20000.3.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
8.2.WindowsUpdate.exe.2a20000.3.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
8.2.WindowsUpdate.exe.2a20000.3.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
8.2.WindowsUpdate.exe.2a20000.3.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x47bd50:$hawkstr1: HawkEye Keylogger 0x47cb7d:$hawkstr1: HawkEye Keylogger 0x47ceac:$hawkstr1: HawkEye Keylogger 0x47d007:$hawkstr1: HawkEye Keylogger 0x47d16a:$hawkstr1: HawkEye Keylogger 0x47d401:$hawkstr1: HawkEye Keylogger 0x47b8de:$hawkstr2: Dear HawkEye Customers! 0x47ceff:$hawkstr2: Dear HawkEye Customers! 0x47d056:$hawkstr2: Dear HawkEye Customers! 0x47d1bd:$hawkstr2: Dear HawkEye Customers! 0x47b9ff:$hawkstr3: HawkEye Logger Details:
13.2.WindowsUpdate.exe.400000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x47b6b7:$key: HawkEyeKeylogger 0x47d905:$salt: 099u787978786 0x47bcf8:$string1: HawkEye_Keylogger 0x47cb37:$string1: HawkEye_Keylogger 0x47d865:$string1: HawkEye_Keylogger 0x47c0cd:$string2: holdermail.txt 0x47c0ed:$string2: holdermail.txt 0x47c00f:$string3: wallet.dat 0x47c027:$string3: wallet.dat 0x47c03d:$string3: wallet.dat 0x47d429:$string4: Keylog Records 0x47d741:$string4: Keylog Records 0x47d95d:$string5: do not script --> 0x47b69f:$string6: \pidloc.txt 0x47b72d:$string7: BSPLIT 0x47b73d:$string7: BSPLIT
13.2.WindowsUpdate.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
13.2.WindowsUpdate.exe.400000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
13.2.WindowsUpdate.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
13.2.WindowsUpdate.exe.400000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x47bd50:$hawkstr1: HawkEye Keylogger 0x47cb7d:$hawkstr1: HawkEye Keylogger 0x47ceac:$hawkstr1: HawkEye Keylogger 0x47d007:$hawkstr1: HawkEye Keylogger 0x47d16a:$hawkstr1: HawkEye Keylogger 0x47d401:$hawkstr1: HawkEye Keylogger 0x47b8de:$hawkstr2: Dear HawkEye Customers! 0x47ceff:$hawkstr2: Dear HawkEye Customers! 0x47d056:$hawkstr2: Dear HawkEye Customers! 0x47d1bd:$hawkstr2: Dear HawkEye Customers! 0x47b9ff:$hawkstr3: HawkEye Logger Details:
12.2.WindowsUpdate.exe.29b0000.3.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x47b6b7:$key: HawkEyeKeylogger 0x47d905:$salt: 099u787978786 0x47bcf8:$string1: HawkEye_Keylogger 0x47cb37:$string1: HawkEye_Keylogger 0x47d865:$string1: HawkEye_Keylogger 0x47c0cd:$string2: holdermail.txt 0x47c0ed:$string2: holdermail.txt 0x47c00f:$string3: wallet.dat 0x47c027:$string3: wallet.dat 0x47c03d:$string3: wallet.dat 0x47d429:$string4: Keylog Records 0x47d741:$string4: Keylog Records 0x47d95d:$string5: do not script --> 0x47b69f:$string6: \pidloc.txt 0x47b72d:$string7: BSPLIT 0x47b73d:$string7: BSPLIT
12.2.WindowsUpdate.exe.29b0000.3.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
12.2.WindowsUpdate.exe.29b0000.3.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
12.2.WindowsUpdate.exe.29b0000.3.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
12.2.WindowsUpdate.exe.29b0000.3.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x47bd50:$hawkstr1: HawkEye Keylogger 0x47cb7d:$hawkstr1: HawkEye Keylogger 0x47ceac:$hawkstr1: HawkEye Keylogger 0x47d007:$hawkstr1: HawkEye Keylogger 0x47d16a:$hawkstr1: HawkEye Keylogger 0x47d401:$hawkstr1: HawkEye Keylogger 0x47b8de:$hawkstr2: Dear HawkEye Customers! 0x47ceff:$hawkstr2: Dear HawkEye Customers! 0x47d056:$hawkstr2: Dear HawkEye Customers! 0x47d1bd:$hawkstr2: Dear HawkEye Customers! 0x47b9ff:$hawkstr3: HawkEye Logger Details:
10.2.WindowsUpdate.exe.2280000.2.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x47b6b7:$key: HawkEyeKeylogger 0x47d905:$salt: 099u787978786 0x47bcf8:$string1: HawkEye_Keylogger 0x47cb37:$string1: HawkEye_Keylogger 0x47d865:$string1: HawkEye_Keylogger 0x47c0cd:$string2: holdermail.txt 0x47c0ed:$string2: holdermail.txt 0x47c00f:$string3: wallet.dat 0x47c027:$string3: wallet.dat 0x47c03d:$string3: wallet.dat 0x47d429:$string4: Keylog Records 0x47d741:$string4: Keylog Records 0x47d95d:$string5: do not script --> 0x47b69f:$string6: \pidloc.txt 0x47b72d:$string7: BSPLIT 0x47b73d:$string7: BSPLIT
10.2.WindowsUpdate.exe.2280000.2.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
10.2.WindowsUpdate.exe.2280000.2.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
10.2.WindowsUpdate.exe.2280000.2.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
10.2.WindowsUpdate.exe.2280000.2.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x47bd50:$hawkstr1: HawkEye Keylogger 0x47cb7d:$hawkstr1: HawkEye Keylogger 0x47ceac:$hawkstr1: HawkEye Keylogger 0x47d007:$hawkstr1: HawkEye Keylogger 0x47d16a:$hawkstr1: HawkEye Keylogger 0x47d401:$hawkstr1: HawkEye Keylogger 0x47b8de:$hawkstr2: Dear HawkEye Customers! 0x47ceff:$hawkstr2: Dear HawkEye Customers! 0x47d056:$hawkstr2: Dear HawkEye Customers! 0x47d1bd:$hawkstr2: Dear HawkEye Customers! 0x47b9ff:$hawkstr3: HawkEye Logger Details:
13.2.WindowsUpdate.exe.9b0000.1.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8b7:$key: HawkEyeKeylogger 0x7db05:$salt: 099u787978786 0x7bef8:$string1: HawkEye_Keylogger 0x7cd37:$string1: HawkEye_Keylogger 0x7da65:$string1: HawkEye_Keylogger 0x7c2cd:$string2: holdermail.txt 0x7c2ed:$string2: holdermail.txt 0x7c20f:$string3: wallet.dat 0x7c227:$string3: wallet.dat 0x7c23d:$string3: wallet.dat 0x7d629:$string4: Keylog Records 0x7d941:$string4: Keylog Records 0x7db5d:$string5: do not script --> 0x7b89f:$string6: \pidloc.txt 0x7b92d:$string7: BSPLIT 0x7b93d:$string7: BSPLIT
13.2.WindowsUpdate.exe.9b0000.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
13.2.WindowsUpdate.exe.9b0000.1.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
13.2.WindowsUpdate.exe.9b0000.1.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
13.2.WindowsUpdate.exe.9b0000.1.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf50:$hawkstr1: HawkEye Keylogger 0x7cd7d:$hawkstr1: HawkEye Keylogger 0x7d0ac:$hawkstr1: HawkEye Keylogger 0x7d207:$hawkstr1: HawkEye Keylogger 0x7d36a:$hawkstr1: HawkEye Keylogger 0x7d601:$hawkstr1: HawkEye Keylogger 0x7bade:$hawkstr2: Dear HawkEye Customers! 0x7d0ff:$hawkstr2: Dear HawkEye Customers! 0x7d256:$hawkstr2: Dear HawkEye Customers! 0x7d3bd:$hawkstr2: Dear HawkEye Customers! 0x7bbff:$hawkstr3: HawkEye Logger Details:
13.2.WindowsUpdate.exe.22f0000.3.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8b7:$key: HawkEyeKeylogger 0x7db05:$salt: 099u787978786 0x7bef8:$string1: HawkEye_Keylogger 0x7cd37:$string1: HawkEye_Keylogger 0x7da65:$string1: HawkEye_Keylogger 0x7c2cd:$string2: holdermail.txt 0x7c2ed:$string2: holdermail.txt 0x7c20f:$string3: wallet.dat 0x7c227:$string3: wallet.dat 0x7c23d:$string3: wallet.dat 0x7d629:$string4: Keylog Records 0x7d941:$string4: Keylog Records 0x7db5d:$string5: do not script --> 0x7b89f:$string6: \pidloc.txt 0x7b92d:$string7: BSPLIT 0x7b93d:$string7: BSPLIT
13.2.WindowsUpdate.exe.22f0000.3.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
13.2.WindowsUpdate.exe.22f0000.3.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
13.2.WindowsUpdate.exe.22f0000.3.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
13.2.WindowsUpdate.exe.22f0000.3.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf50:$hawkstr1: HawkEye Keylogger 0x7cd7d:$hawkstr1: HawkEye Keylogger 0x7d0ac:$hawkstr1: HawkEye Keylogger 0x7d207:$hawkstr1: HawkEye Keylogger 0x7d36a:$hawkstr1: HawkEye Keylogger 0x7d601:$hawkstr1: HawkEye Keylogger 0x7bade:$hawkstr2: Dear HawkEye Customers! 0x7d0ff:$hawkstr2: Dear HawkEye Customers! 0x7d256:$hawkstr2: Dear HawkEye Customers! 0x7d3bd:$hawkstr2: Dear HawkEye Customers! 0x7bbff:$hawkstr3: HawkEye Logger Details:
10.2.WindowsUpdate.exe.400000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x47b6b7:$key: HawkEyeKeylogger 0x47d905:$salt: 099u787978786 0x47bcf8:$string1: HawkEye_Keylogger 0x47cb37:$string1: HawkEye_Keylogger 0x47d865:$string1: HawkEye_Keylogger 0x47c0cd:$string2: holdermail.txt 0x47c0ed:$string2: holdermail.txt 0x47c00f:$string3: wallet.dat 0x47c027:$string3: wallet.dat 0x47c03d:$string3: wallet.dat 0x47d429:$string4: Keylog Records 0x47d741:$string4: Keylog Records 0x47d95d:$string5: do not script --> 0x47b69f:$string6: \pidloc.txt 0x47b72d:$string7: BSPLIT 0x47b73d:$string7: BSPLIT
10.2.WindowsUpdate.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
10.2.WindowsUpdate.exe.400000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
10.2.WindowsUpdate.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
10.2.WindowsUpdate.exe.400000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x47bd50:$hawkstr1: HawkEye Keylogger 0x47cb7d:$hawkstr1: HawkEye Keylogger 0x47ceac:$hawkstr1: HawkEye Keylogger 0x47d007:$hawkstr1: HawkEye Keylogger 0x47d16a:$hawkstr1: HawkEye Keylogger 0x47d401:$hawkstr1: HawkEye Keylogger 0x47b8de:$hawkstr2: Dear HawkEye Customers! 0x47ceff:$hawkstr2: Dear HawkEye Customers! 0x47d056:$hawkstr2: Dear HawkEye Customers! 0x47d1bd:$hawkstr2: Dear HawkEye Customers! 0x47b9ff:$hawkstr3: HawkEye Logger Details:
1.2.mR3CdUkyLL.exe.400000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x47b6b7:$key: HawkEyeKeylogger 0x47d905:$salt: 099u787978786 0x47bcf8:$string1: HawkEye_Keylogger 0x47cb37:$string1: HawkEye_Keylogger 0x47d865:$string1: HawkEye_Keylogger 0x47c0cd:$string2: holdermail.txt 0x47c0ed:$string2: holdermail.txt 0x47c00f:$string3: wallet.dat 0x47c027:$string3: wallet.dat 0x47c03d:$string3: wallet.dat 0x47d429:$string4: Keylog Records 0x47d741:$string4: Keylog Records 0x47d95d:$string5: do not script --> 0x47b69f:$string6: \pidloc.txt 0x47b72d:$string7: BSPLIT 0x47b73d:$string7: BSPLIT
1.2.mR3CdUkyLL.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.mR3CdUkyLL.exe.400000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.mR3CdUkyLL.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.mR3CdUkyLL.exe.400000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x47bd50:$hawkstr1: HawkEye Keylogger 0x47cb7d:$hawkstr1: HawkEye Keylogger 0x47ceac:$hawkstr1: HawkEye Keylogger 0x47d007:$hawkstr1: HawkEye Keylogger 0x47d16a:$hawkstr1: HawkEye Keylogger 0x47d401:$hawkstr1: HawkEye Keylogger 0x47b8de:$hawkstr2: Dear HawkEye Customers! 0x47ceff:$hawkstr2: Dear HawkEye Customers! 0x47d056:$hawkstr2: Dear HawkEye Customers! 0x47d1bd:$hawkstr2: Dear HawkEye Customers! 0x47b9ff:$hawkstr3: HawkEye Logger Details:
Click to see the 103 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: mR3CdUkyLL.exe.6092.1.memstr	Malware Configuration Extractor: HawkEye {"Modules": ["WebBrowserPassView", "mailpv", "Mail PassView"], "Version": ""}
Source: mR3CdUkyLL.exe.6092.1.memstr	Malware Configuration Extractor: HawkEye {"Modules": ["WebBrowserPassView", "mailpv", "Mail PassView"], "Version": ""}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe	Metadefender: Detection: 37%	Perma Link
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe	Metadefender: Detection: 37%	Perma Link
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe	ReversingLabs: Detection: 60%

Multi AV Scanner detection for submitted file

Show sources

Source: mR3CdUkyLL.exe	Metadefender: Detection: 37%	Perma Link
Source: mR3CdUkyLL.exe	ReversingLabs: Detection: 60%
Source: mR3CdUkyLL.exe	Metadefender: Detection: 37%	Perma Link
Source: mR3CdUkyLL.exe	ReversingLabs: Detection: 60%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: mR3CdUkyLL.exe	Joe Sandbox ML: detected
Source: mR3CdUkyLL.exe	Joe Sandbox ML: detected

Source: 0.2.mR3CdUkyLL.exe.29c0000.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.2.WindowsUpdate.exe.9b0000.1.unpack	Avira: Label: TR/Inject.vcoldi
Source: 10.2.WindowsUpdate.exe.a30000.1.unpack	Avira: Label: TR/Inject.vcoldi
Source: 8.2.WindowsUpdate.exe.2a20000.3.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 8.2.WindowsUpdate.exe.2a20000.3.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 1.2.mR3CdUkyLL.exe.22b0000.2.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 1.2.mR3CdUkyLL.exe.22b0000.2.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 13.2.WindowsUpdate.exe.2260000.2.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 13.2.WindowsUpdate.exe.2260000.2.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 10.2.WindowsUpdate.exe.2360000.3.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 10.2.WindowsUpdate.exe.2360000.3.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 1.2.mR3CdUkyLL.exe.2220000.1.unpack	Avira: Label: TR/Inject.vcoldi
Source: 1.2.mR3CdUkyLL.exe.2340000.3.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 1.2.mR3CdUkyLL.exe.2340000.3.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 0.2.mR3CdUkyLL.exe.2a10000.3.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 0.2.mR3CdUkyLL.exe.2a10000.3.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 13.2.WindowsUpdate.exe.400000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 13.2.WindowsUpdate.exe.400000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 1.1.mR3CdUkyLL.exe.400000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 1.1.mR3CdUkyLL.exe.400000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 10.2.WindowsUpdate.exe.2280000.2.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 10.2.WindowsUpdate.exe.2280000.2.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 12.2.WindowsUpdate.exe.29b0000.3.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 12.2.WindowsUpdate.exe.29b0000.3.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 10.2.WindowsUpdate.exe.400000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 10.2.WindowsUpdate.exe.400000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 1.2.mR3CdUkyLL.exe.400000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 1.2.mR3CdUkyLL.exe.400000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 12.2.WindowsUpdate.exe.23d0000.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.2.WindowsUpdate.exe.22f0000.3.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 13.2.WindowsUpdate.exe.22f0000.3.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 0.2.mR3CdUkyLL.exe.29c0000.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.2.WindowsUpdate.exe.9b0000.1.unpack	Avira: Label: TR/Inject.vcoldi
Source: 10.2.WindowsUpdate.exe.a30000.1.unpack	Avira: Label: TR/Inject.vcoldi
Source: 8.2.WindowsUpdate.exe.2a20000.3.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 8.2.WindowsUpdate.exe.2a20000.3.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 1.2.mR3CdUkyLL.exe.22b0000.2.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 1.2.mR3CdUkyLL.exe.22b0000.2.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 13.2.WindowsUpdate.exe.2260000.2.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 13.2.WindowsUpdate.exe.2260000.2.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 10.2.WindowsUpdate.exe.2360000.3.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 10.2.WindowsUpdate.exe.2360000.3.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 1.2.mR3CdUkyLL.exe.2220000.1.unpack	Avira: Label: TR/Inject.vcoldi
Source: 1.2.mR3CdUkyLL.exe.2340000.3.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 1.2.mR3CdUkyLL.exe.2340000.3.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 0.2.mR3CdUkyLL.exe.2a10000.3.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 0.2.mR3CdUkyLL.exe.2a10000.3.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 13.2.WindowsUpdate.exe.400000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 13.2.WindowsUpdate.exe.400000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 1.1.mR3CdUkyLL.exe.400000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 1.1.mR3CdUkyLL.exe.400000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 10.2.WindowsUpdate.exe.2280000.2.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 10.2.WindowsUpdate.exe.2280000.2.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 12.2.WindowsUpdate.exe.29b0000.3.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 12.2.WindowsUpdate.exe.29b0000.3.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 10.2.WindowsUpdate.exe.400000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 10.2.WindowsUpdate.exe.400000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 1.2.mR3CdUkyLL.exe.400000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 1.2.mR3CdUkyLL.exe.400000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 12.2.WindowsUpdate.exe.23d0000.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.2.WindowsUpdate.exe.22f0000.3.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 13.2.WindowsUpdate.exe.22f0000.3.unpack	Avira: Label: SPR/Tool.MailPassView.473

Source: mR3CdUkyLL.exe, 00000000.00000002.215363320.0000000002AA7000.00000040.00000001.sdmp	Binary or memory string: autorun.inf
Source: mR3CdUkyLL.exe, 00000000.00000002.215363320.0000000002AA7000.00000040.00000001.sdmp	Binary or memory string: [autorun]
Source: mR3CdUkyLL.exe	Binary or memory string: autorun.inf
Source: mR3CdUkyLL.exe	Binary or memory string: [autorun]
Source: WindowsUpdate.exe, 00000008.00000002.264075129.0000000002A22000.00000040.00000001.sdmp	Binary or memory string: autorun.inf
Source: WindowsUpdate.exe, 00000008.00000002.264075129.0000000002A22000.00000040.00000001.sdmp	Binary or memory string: [autorun]
Source: WindowsUpdate.exe, 0000000A.00000002.287705631.0000000000A30000.00000004.00000001.sdmp	Binary or memory string: autorun.inf
Source: WindowsUpdate.exe, 0000000A.00000002.287705631.0000000000A30000.00000004.00000001.sdmp	Binary or memory string: [autorun]
Source: WindowsUpdate.exe, 0000000C.00000002.281779218.0000000002A47000.00000040.00000001.sdmp	Binary or memory string: autorun.inf
Source: WindowsUpdate.exe, 0000000C.00000002.281779218.0000000002A47000.00000040.00000001.sdmp	Binary or memory string: [autorun]
Source: WindowsUpdate.exe, 0000000D.00000002.284301101.0000000000497000.00000040.00000001.sdmp	Binary or memory string: autorun.inf
Source: WindowsUpdate.exe, 0000000D.00000002.284301101.0000000000497000.00000040.00000001.sdmp	Binary or memory string: [autorun]
Source: mR3CdUkyLL.exe, 00000000.00000002.215363320.0000000002AA7000.00000040.00000001.sdmp	Binary or memory string: autorun.inf
Source: mR3CdUkyLL.exe, 00000000.00000002.215363320.0000000002AA7000.00000040.00000001.sdmp	Binary or memory string: [autorun]
Source: mR3CdUkyLL.exe	Binary or memory string: autorun.inf
Source: mR3CdUkyLL.exe	Binary or memory string: [autorun]
Source: WindowsUpdate.exe, 00000008.00000002.264075129.0000000002A22000.00000040.00000001.sdmp	Binary or memory string: autorun.inf
Source: WindowsUpdate.exe, 00000008.00000002.264075129.0000000002A22000.00000040.00000001.sdmp	Binary or memory string: [autorun]
Source: WindowsUpdate.exe, 0000000A.00000002.287705631.0000000000A30000.00000004.00000001.sdmp	Binary or memory string: autorun.inf
Source: WindowsUpdate.exe, 0000000A.00000002.287705631.0000000000A30000.00000004.00000001.sdmp	Binary or memory string: [autorun]
Source: WindowsUpdate.exe, 0000000C.00000002.281779218.0000000002A47000.00000040.00000001.sdmp	Binary or memory string: autorun.inf
Source: WindowsUpdate.exe, 0000000C.00000002.281779218.0000000002A47000.00000040.00000001.sdmp	Binary or memory string: [autorun]
Source: WindowsUpdate.exe, 0000000D.00000002.284301101.0000000000497000.00000040.00000001.sdmp	Binary or memory string: autorun.inf
Source: WindowsUpdate.exe, 0000000D.00000002.284301101.0000000000497000.00000040.00000001.sdmp	Binary or memory string: [autorun]

Source: C:\Users\user\Desktop\mR3CdUkyLL.exe	Code function: 0_2_0047A5CC FindFirstFileA,GetLastError,FindClose,
Source: C:\Users\user\Desktop\mR3CdUkyLL.exe	Code function: 0_2_00408AA8 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,
Source: C:\Users\user\Desktop\mR3CdUkyLL.exe	Code function: 0_2_00408B84 FindFirstFileA,GetLastError,
Source: C:\Users\user\Desktop\mR3CdUkyLL.exe	Code function: 0_2_00405B94 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,
Source: C:\Users\user\Desktop\mR3CdUkyLL.exe	Code function: 0_2_0047A5CC FindFirstFileA,GetLastError,FindClose,
Source: C:\Users\user\Desktop\mR3CdUkyLL.exe	Code function: 0_2_00408AA8 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,
Source: C:\Users\user\Desktop\mR3CdUkyLL.exe	Code function: 0_2_00408B84 FindFirstFileA,GetLastError,
Source: C:\Users\user\Desktop\mR3CdUkyLL.exe	Code function: 0_2_00405B94 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 4_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 4_2_00407E0E FindFirstFileW,FindNextFileW,FindClose,
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe	Code function: 8_2_0047A5CC FindFirstFileA,GetLastError,FindClose,
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe	Code function: 8_2_00408AA8 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe	Code function: 8_2_00408B84 FindFirstFileA,GetLastError,
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exe	Code function: 8_2_00405B94 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,

Networking:

May check the online IP address of the machine

Show sources

Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.16.155.36 104.16.155.36
Source: Joe Sandbox View	IP Address: 104.16.155.36 104.16.155.36

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comConnection: Keep-Alive

Source: mR3CdUkyLL.exe, 00000000.00000002.215363320.0000000002AA7000.00000040.00000001.sdmp, mR3CdUkyLL.exe, 00000001.00000002.291517434.0000000003A51000.00000004.00000001.sdmp, vbc.exe, 00000004.00000002.254178019.0000000000400000.00000040.00000001.sdmp, WindowsUpdate.exe, 00000008.00000002.264075129.0000000002A22000.00000040.00000001.sdmp, WindowsUpdate.exe, 0000000A.00000002.287705631.0000000000A30000.00000004.00000001.sdmp, WindowsUpdate.exe, 0000000C.00000002.281779218.0000000002A47000.00000040.00000001.sdmp, WindowsUpdate.exe, 0000000D.00000002.284301101.0000000000497000.00000040.00000001.sdmp	String found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: mR3CdUkyLL.exe, 00000000.00000002.215363320.0000000002AA7000.00000040.00000001.sdmp, mR3CdUkyLL.exe, 00000001.00000002.291517434.0000000003A51000.00000004.00000001.sdmp, vbc.exe, 00000004.00000002.254178019.0000000000400000.00000040.00000001.sdmp, WindowsUpdate.exe, 00000008.00000002.264075129.0000000002A22000.00000040.00000001.sdmp, WindowsUpdate.exe, 0000000A.00000002.287705631.0000000000A30000.00000004.00000001.sdmp, WindowsUpdate.exe, 0000000C.00000002.281779218.0000000002A47000.00000040.00000001.sdmp, WindowsUpdate.exe, 0000000D.00000002.284301101.0000000000497000.00000040.00000001.sdmp	String found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: mR3CdUkyLL.exe, vbc.exe	String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: vbc.exe, 00000004.00000003.254000875.0000000000A4C000.00000004.00000001.sdmp	String found in binary or memory: s://www.microsoft.com/en-us/welcomeie11/https://www.microsoft.com/en-us/edge?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edgehttps://www.microsoft.com/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/edge/https://www.microsoft.com/en-us/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edge/https://www.google.com/chrome/https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0https://www.google.com/chrome/thank-you.htmlhttps://www.bing.com/search?q=chrome+download&src=IE-SearchBox&FORM=IESR4A&pc=EUPP_https://www.bing.com/searchhttps://go.microsoft.com/fwlink/?LinkId=838604https://go.microsoft.com/fwlink/https://go.microsoft.com/fwlink/p/?LinkId=255141https://go.microsoft.com/fwlink/p/https://go.microsoft.com/fwlink/?LinkId=517287res://C:\Windows\system32\mmcndmgr.dll/views.htmhttp://www.msn.com/?ocid=iehphttp://www.msn.com/http://www.msn.com/de-ch/?ocid=iehphttp://www.msn.com/de-ch/http://go.microsoft.com/fwlink/?LinkId=838604http://go.microsoft.com/fwlink/http://go.microsoft.com/fwlink/p/?LinkId=255141http://go.microsoft.com/fwlink/p/https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login. equals www.facebook.com (Facebook)
Source: vbc.exe, 00000004.00000003.254000875.0000000000A4C000.00000004.00000001.sdmp	String found in binary or memory: s://www.microsoft.com/en-us/welcomeie11/https://www.microsoft.com/en-us/edge?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edgehttps://www.microsoft.com/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/edge/https://www.microsoft.com/en-us/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edge/https://www.google.com/chrome/https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0https://www.google.com/chrome/thank-you.htmlhttps://www.bing.com/search?q=chrome+download&src=IE-SearchBox&FORM=IESR4A&pc=EUPP_https://www.bing.com/searchhttps://go.microsoft.com/fwlink/?LinkId=838604https://go.microsoft.com/fwlink/https://go.microsoft.com/fwlink/p/?LinkId=255141https://go.microsoft.com/fwlink/p/https://go.microsoft.com/fwlink/?LinkId=517287res://C:\Windows\system32\mmcndmgr.dll/views.htmhttp://www.msn.com/?ocid=iehphttp://www.msn.com/http://www.msn.com/de-ch/?ocid=iehphttp://www.msn.com/de-ch/http://go.microsoft.com/fwlink/?LinkId=838604http://go.microsoft.com/fwlink/http://go.microsoft.com/fwlink/p/?LinkId=255141http://go.microsoft.com/fwlink/p/https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login. equals www.yahoo.com (Yahoo)
Source: mR3CdUkyLL.exe, 00000000.00000002.215363320.0000000002AA7000.00000040.00000001.sdmp, mR3CdUkyLL.exe, 00000001.00000002.291517434.0000000003A51000.00000004.00000001.sdmp, vbc.exe, 00000004.00000002.254178019.0000000000400000.00000040.00000001.sdmp, WindowsUpdate.exe, 00000008.00000002.264075129.0000000002A22000.00000040.00000001.sdmp, WindowsUpdate.exe, 0000000A.00000002.287705631.0000000000A30000.00000004.00000001.sdmp, WindowsUpdate.exe, 0000000C.00000002.281779218.0000000002A47000.00000040.00000001.sdmp, WindowsUpdate.exe, 0000000D.00000002.284301101.0000000000497000.00000040.00000001.sdmp	String found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: mR3CdUkyLL.exe, 00000000.00000002.215363320.0000000002AA7000.00000040.00000001.sdmp, mR3CdUkyLL.exe, 00000001.00000002.291517434.0000000003A51000.00000004.00000001.sdmp, vbc.exe, 00000004.00000002.254178019.0000000000400000.00000040.00000001.sdmp, WindowsUpdate.exe, 00000008.00000002.264075129.0000000002A22000.00000040.00000001.sdmp, WindowsUpdate.exe, 0000000A.00000002.287705631.0000000000A30000.00000004.00000001.sdmp, WindowsUpdate.exe, 0000000C.00000002.281779218.0000000002A47000.00000040.00000001.sdmp, WindowsUpdate.exe, 0000000D.00000002.284301101.0000000000497000.00000040.00000001.sdmp	String found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: mR3CdUkyLL.exe, vbc.exe	String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: vbc.exe, 00000004.00000003.254000875.0000000000A4C000.00000004.00000001.sdmp	String found in binary or memory: s://www.microsoft.com/en-us/welcomeie11/https://www.microsoft.com/en-us/edge?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edgehttps://www.microsoft.com/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/edge/https://www.microsoft.com/en-us/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edge/https://www.google.com/chrome/https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0https://www.google.com/chrome/thank-you.htmlhttps://www.bing.com/search?q=chrome+download&src=IE-SearchBox&FORM=IESR4A&pc=EUPP_https://www.bing.com/searchhttps://go.microsoft.com/fwlink/?LinkId=838604https://go.microsoft.com/fwlink/https://go.microsoft.com/fwlink/p/?LinkId=255141https://go.microsoft.com/fwlink/p/https://go.microsoft.com/fwlink/?LinkId=517287res://C:\Windows\system32\mmcndmgr.dll/views.htmhttp://www.msn.com/?ocid=iehphttp://www.msn.com/http://www.msn.com/de-ch/?ocid=iehphttp://www.msn.com/de-ch/http://go.microsoft.com/fwlink/?LinkId=838604http://go.microsoft.com/fwlink/http://go.microsoft.com/fwlink/p/?LinkId=255141http://go.microsoft.com/fwlink/p/https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login. equals www.facebook.com (Facebook)
Source: vbc.exe, 00000004.00000003.254000875.0000000000A4C000.00000004.00000001.sdmp	String found in binary or memory: s://www.microsoft.com/en-us/welcomeie11/https://www.microsoft.com/en-us/edge?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edgehttps://www.microsoft.com/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/edge/https://www.microsoft.com/en-us/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edge/https://www.google.com/chrome/https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0https://www.google.com/chrome/thank-you.htmlhttps://www.bing.com/search?q=chrome+download&src=IE-SearchBox&FORM=IESR4A&pc=EUPP_https://www.bing.com/searchhttps://go.microsoft.com/fwlink/?LinkId=838604https://go.microsoft.com/fwlink/https://go.microsoft.com/fwlink/p/?LinkId=255141https://go.microsoft.com/fwlink/p/https://go.microsoft.com/fwlink/?LinkId=517287res://C:\Windows\system32\mmcndmgr.dll/views.htmhttp://www.msn.com/?ocid=iehphttp://www.msn.com/http://www.msn.com/de-ch/?ocid=iehphttp://www.msn.com/de-ch/http://go.microsoft.com/fwlink/?LinkId=838604http://go.microsoft.com/fwlink/http://go.microsoft.com/fwlink/p/?LinkId=255141http://go.microsoft.com/fwlink/p/https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login. equals www.yahoo.com (Yahoo)

Source: unknown	DNS traffic detected: queries for: 59.60.14.0.in-addr.arpa
Source: unknown	DNS traffic detected: queries for: 59.60.14.0.in-addr.arpa

Source: mR3CdUkyLL.exe, 00000000.00000002.215363320.0000000002AA7000.00000040.00000001.sdmp, mR3CdUkyLL.exe, 00000001.00000002.291517434.0000000003A51000.00000004.00000001.sdmp, WindowsUpdate.exe, 00000008.00000002.264075129.0000000002A22000.00000040.00000001.sdmp, WindowsUpdate.exe, 0000000A.00000002.287705631.0000000000A30000.00000004.00000001.sdmp, WindowsUpdate.exe, 0000000C.00000002.281779218.0000000002A47000.00000040.00000001.sdmp, WindowsUpdate.exe, 0000000D.00000002.284301101.0000000000497000.00000040.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: mR3CdUkyLL.exe, 00000001.00000003.216746551.0000000004F5D000.00000004.00000001.sdmp	String found in binary or memory: http://en.wUi
Source: mR3CdUkyLL.exe, 00000001.00000002.293402217.0000000006222000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: WindowsUpdate.exe, 0000000A.00000002.295211103.0000000002A81000.00000004.00000001.sdmp, WindowsUpdate.exe, 0000000D.00000002.295188375.0000000002A21000.00000004.00000001.sdmp	String found in binary or memory: http://foo.com/fooT
Source: mR3CdUkyLL.exe, 00000000.00000002.215363320.0000000002AA7000.00000040.00000001.sdmp, mR3CdUkyLL.exe, 00000001.00000002.291517434.0000000003A51000.00000004.00000001.sdmp, WindowsUpdate.exe, 00000008.00000002.264075129.0000000002A22000.00000040.00000001.sdmp, WindowsUpdate.exe, 0000000A.00000002.287705631.0000000000A30000.00000004.00000001.sdmp, WindowsUpdate.exe, 0000000C.00000002.281779218.0000000002A47000.00000040.00000001.sdmp, WindowsUpdate.exe, 0000000D.00000002.284301101.0000000000497000.00000040.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: mR3CdUkyLL.exe, 00000001.00000002.287736407.0000000002A51000.00000004.00000001.sdmp	String found in binary or me

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report mR3CdUkyLL

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: HawkEye

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Spreading:

Networking: