Play interactive tour

Edit tour

Analysis Report Orders.exe

Overview

General Information

Sample Name:	Orders.exe
Analysis ID:	346555
MD5:	e85daf3a43f107b213310a53bfd35aa9
SHA1:	042208c7a232b806c6382e34417f9c8e2a955747
SHA256:	0b1fbc81d9d9e685307e80d20afe4b01c6538b903b77136b0d1db2486fe8c6e8
Tags:	exeYahoo
Most interesting Screenshot:

Detection

HawkEye AgentTesla MailPassView Matiex

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Detected HawkEye Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected AgentTesla

Yara detected AntiVM_3

Yara detected HawkEye Keylogger

Yara detected MailPassView

Yara detected Matiex Keylogger

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Binary contains a suspicious time stamp

Bypasses PowerShell execution policy

Changes the view of files in windows explorer (hidden files and folders)

Contains functionality to log keystrokes (.Net Source)

Drops PE files to the startup folder

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

May check the online IP address of the machine

Opens the same file many times (likely Sandbox evasion)

Powershell drops PE file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses process hollowing technique

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Yara detected WebBrowserPassView password recovery tool

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Antivirus or Machine Learning detection for unpacked file

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains strange resources

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Tries to load missing DLLs

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Startup

System is w10x64

Orders.exe (PID: 6824 cmdline: 'C:\Users\user\Desktop\Orders.exe' MD5: E85DAF3A43F107B213310A53BFD35AA9)

powershell.exe (PID: 6896 cmdline: 'Powershell.exe' -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\Orders.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe' MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 6912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegAsm.exe (PID: 7000 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)

hawkgoods.exe (PID: 7064 cmdline: 'C:\Users\user~1\AppData\Local\Temp\hawkgoods.exe' 0 MD5: FFDB58533D5D1362E896E96FB6F02A95)

dw20.exe (PID: 6008 cmdline: dw20.exe -x -s 2132 MD5: 8D10DA8A3E11747E51F23C882C22BBC3)

vbc.exe (PID: 6288 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)

vbc.exe (PID: 976 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)

WerFault.exe (PID: 6308 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 176 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 2324 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7064 -s 2132 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

origigoods40.exe (PID: 7116 cmdline: 'C:\Users\user~1\AppData\Local\Temp\origigoods40.exe' 0 MD5: AE36F0D16230B9F41FFECBD3C5B1D660)

Matiexgoods.exe (PID: 7148 cmdline: 'C:\Users\user~1\AppData\Local\Temp\Matiexgoods.exe' 0 MD5: 80C61B903400B534858D047DD0919F0E)

netsh.exe (PID: 6780 cmdline: 'netsh' wlan show profile MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 1404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

origigoods20.exe (PID: 5580 cmdline: 'C:\Users\user~1\AppData\Local\Temp\origigoods20.exe' 0 MD5: 61DC57C6575E1F3F2AE14C1B332AD2FB)

WerFault.exe (PID: 2116 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6824 -s 1104 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

I$s#$lT3ssl.exe (PID: 5184 cmdline: 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe' MD5: E85DAF3A43F107B213310A53BFD35AA9)

powershell.exe (PID: 5296 cmdline: 'Powershell.exe' -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe' MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 5428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegAsm.exe (PID: 5468 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)

hawkgoods.exe (PID: 4388 cmdline: 'C:\Users\user~1\AppData\Local\Temp\hawkgoods.exe' 0 MD5: FFDB58533D5D1362E896E96FB6F02A95)

origigoods40.exe (PID: 5692 cmdline: 'C:\Users\user~1\AppData\Local\Temp\origigoods40.exe' 0 MD5: AE36F0D16230B9F41FFECBD3C5B1D660)

Matiexgoods.exe (PID: 6724 cmdline: 'C:\Users\user~1\AppData\Local\Temp\Matiexgoods.exe' 0 MD5: 80C61B903400B534858D047DD0919F0E)

origigoods20.exe (PID: 5612 cmdline: 'C:\Users\user~1\AppData\Local\Temp\origigoods20.exe' 0 MD5: 61DC57C6575E1F3F2AE14C1B332AD2FB)

WerFault.exe (PID: 2160 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5184 -s 1096 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: HawkEye

{"Modules": ["WebBrowserPassView", "mailpv", "Mail PassView"], "Version": ""}

Threatname: Agenttesla

{"Username: ": "", "URL: ": "", "To: ": "sales1@midombo.com", "ByHost: ": "smtp.privateemail.com:587", "Password: ": "", "From: ": "sales1@midombo.com"}

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\origigoods20.exe	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
C:\Users\user\AppData\Local\Temp\origigoods40.exe	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
C:\Users\user\AppData\Local\Temp\Matiexgoods.exe	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
C:\Users\user\AppData\Local\Temp\hawkgoods.exe	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
C:\Users\user\AppData\Local\Temp\hawkgoods.exe	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c7:$key: HawkEyeKeylogger 0x7db0b:$salt: 099u787978786 0x7bf08:$string1: HawkEye_Keylogger 0x7cd5b:$string1: HawkEye_Keylogger 0x7da6b:$string1: HawkEye_Keylogger 0x7c2f1:$string2: holdermail.txt 0x7c311:$string2: holdermail.txt 0x7c233:$string3: wallet.dat 0x7c24b:$string3: wallet.dat 0x7c261:$string3: wallet.dat 0x7d62f:$string4: Keylog Records 0x7d947:$string4: Keylog Records 0x7db63:$string5: do not script --> 0x7b8af:$string6: \pidloc.txt 0x7b93d:$string7: BSPLIT 0x7b94d:$string7: BSPLIT
C:\Users\user\AppData\Local\Temp\hawkgoods.exe	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
C:\Users\user\AppData\Local\Temp\hawkgoods.exe	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
C:\Users\user\AppData\Local\Temp\hawkgoods.exe	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
C:\Users\user\AppData\Local\Temp\hawkgoods.exe	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf60:$hawkstr1: HawkEye Keylogger 0x7cda1:$hawkstr1: HawkEye Keylogger 0x7d0d0:$hawkstr1: HawkEye Keylogger 0x7d22b:$hawkstr1: HawkEye Keylogger 0x7d38e:$hawkstr1: HawkEye Keylogger 0x7d607:$hawkstr1: HawkEye Keylogger 0x7baee:$hawkstr2: Dear HawkEye Customers! 0x7d123:$hawkstr2: Dear HawkEye Customers! 0x7d27a:$hawkstr2: Dear HawkEye Customers! 0x7d3e1:$hawkstr2: Dear HawkEye Customers! 0x7bc0f:$hawkstr3: HawkEye Logger Details:
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000025.00000000.399012238.0000000000E72000.00000002.00020000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000017.00000002.450940492.0000000005360000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x12df7:$key: HawkEyeKeylogger 0x1503b:$salt: 099u787978786 0x13438:$string1: HawkEye_Keylogger 0x1428b:$string1: HawkEye_Keylogger 0x14f9b:$string1: HawkEye_Keylogger 0x13821:$string2: holdermail.txt 0x13841:$string2: holdermail.txt 0x13763:$string3: wallet.dat 0x1377b:$string3: wallet.dat 0x13791:$string3: wallet.dat 0x14b5f:$string4: Keylog Records 0x14e77:$string4: Keylog Records 0x15093:$string5: do not script --> 0x12ddf:$string6: \pidloc.txt 0x12e6d:$string7: BSPLIT 0x12e7d:$string7: BSPLIT
00000017.00000002.450940492.0000000005360000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000017.00000002.450940492.0000000005360000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x13490:$hawkstr1: HawkEye Keylogger 0x142d1:$hawkstr1: HawkEye Keylogger 0x14600:$hawkstr1: HawkEye Keylogger 0x1475b:$hawkstr1: HawkEye Keylogger 0x148be:$hawkstr1: HawkEye Keylogger 0x14b37:$hawkstr1: HawkEye Keylogger 0x1301e:$hawkstr2: Dear HawkEye Customers! 0x14653:$hawkstr2: Dear HawkEye Customers! 0x147aa:$hawkstr2: Dear HawkEye Customers! 0x14911:$hawkstr2: Dear HawkEye Customers! 0x1313f:$hawkstr3: HawkEye Logger Details:
00000027.00000000.408264262.0000000000532000.00000002.00020000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000021.00000003.409742316.0000000003D5B000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.503829429.0000000003E11000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000006.00000002.503829429.0000000003E11000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000004.00000003.246774488.0000000003670000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8e7:$key: HawkEyeKeylogger 0x7db2b:$salt: 099u787978786 0x7bf28:$string1: HawkEye_Keylogger 0x7cd7b:$string1: HawkEye_Keylogger 0x7da8b:$string1: HawkEye_Keylogger 0x7c311:$string2: holdermail.txt 0x7c331:$string2: holdermail.txt 0x7c253:$string3: wallet.dat 0x7c26b:$string3: wallet.dat 0x7c281:$string3: wallet.dat 0x7d64f:$string4: Keylog Records 0x7d967:$string4: Keylog Records 0x7db83:$string5: do not script --> 0x7b8cf:$string6: \pidloc.txt 0x7b95d:$string7: BSPLIT 0x7b96d:$string7: BSPLIT
00000004.00000003.246774488.0000000003670000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000004.00000003.246774488.0000000003670000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000004.00000003.246774488.0000000003670000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000004.00000003.246774488.0000000003670000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf80:$hawkstr1: HawkEye Keylogger 0x7cdc1:$hawkstr1: HawkEye Keylogger 0x7d0f0:$hawkstr1: HawkEye Keylogger 0x7d24b:$hawkstr1: HawkEye Keylogger 0x7d3ae:$hawkstr1: HawkEye Keylogger 0x7d627:$hawkstr1: HawkEye Keylogger 0x7bb0e:$hawkstr2: Dear HawkEye Customers! 0x7d143:$hawkstr2: Dear HawkEye Customers! 0x7d29a:$hawkstr2: Dear HawkEye Customers! 0x7d401:$hawkstr2: Dear HawkEye Customers! 0x7bc2f:$hawkstr3: HawkEye Logger Details:
00000021.00000003.401891116.0000000001453000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000003.251635347.0000000003EBD000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000021.00000003.402397368.000000000405D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000003.256024655.0000000001293000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000021.00000003.413799540.0000000003FF1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.520293841.0000000007DA0000.00000004.00000001.sdmp	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
00000004.00000003.255331829.0000000003EBD000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000000.249359249.0000000000672000.00000002.00020000.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6c7:$key: HawkEyeKeylogger 0x7d90b:$salt: 099u787978786 0x7bd08:$string1: HawkEye_Keylogger 0x7cb5b:$string1: HawkEye_Keylogger 0x7d86b:$string1: HawkEye_Keylogger 0x7c0f1:$string2: holdermail.txt 0x7c111:$string2: holdermail.txt 0x7c033:$string3: wallet.dat 0x7c04b:$string3: wallet.dat 0x7c061:$string3: wallet.dat 0x7d42f:$string4: Keylog Records 0x7d747:$string4: Keylog Records 0x7d963:$string5: do not script --> 0x7b6af:$string6: \pidloc.txt 0x7b73d:$string7: BSPLIT 0x7b74d:$string7: BSPLIT
00000006.00000000.249359249.0000000000672000.00000002.00020000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000006.00000000.249359249.0000000000672000.00000002.00020000.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000006.00000000.249359249.0000000000672000.00000002.00020000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000006.00000000.249359249.0000000000672000.00000002.00020000.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd60:$hawkstr1: HawkEye Keylogger 0x7cba1:$hawkstr1: HawkEye Keylogger 0x7ced0:$hawkstr1: HawkEye Keylogger 0x7d02b:$hawkstr1: HawkEye Keylogger 0x7d18e:$hawkstr1: HawkEye Keylogger 0x7d407:$hawkstr1: HawkEye Keylogger 0x7b8ee:$hawkstr2: Dear HawkEye Customers! 0x7cf23:$hawkstr2: Dear HawkEye Customers! 0x7d07a:$hawkstr2: Dear HawkEye Customers! 0x7d1e1:$hawkstr2: Dear HawkEye Customers! 0x7ba0f:$hawkstr3: HawkEye Logger Details:
0000000A.00000002.416654984.0000000000682000.00000002.00020000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000000.251123537.00000000000F2000.00000002.00020000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.256501427.0000000000403000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7ba86:$key: HawkEyeKeylogger 0x7dcca:$salt: 099u787978786 0x7c0c7:$string1: HawkEye_Keylogger 0x7cf1a:$string1: HawkEye_Keylogger 0x7dc2a:$string1: HawkEye_Keylogger 0x7c4b0:$string2: holdermail.txt 0x7c4d0:$string2: holdermail.txt 0x7c3f2:$string3: wallet.dat 0x7c40a:$string3: wallet.dat 0x7c420:$string3: wallet.dat 0x7d7ee:$string4: Keylog Records 0x7db06:$string4: Keylog Records 0x7dd22:$string5: do not script --> 0x7ba6e:$string6: \pidloc.txt 0x7bafc:$string7: BSPLIT 0x7bb0c:$string7: BSPLIT
00000004.00000002.256501427.0000000000403000.00000040.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000004.00000002.256501427.0000000000403000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000004.00000002.256501427.0000000000403000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000004.00000002.256501427.0000000000403000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000004.00000002.256501427.0000000000403000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c11f:$hawkstr1: HawkEye Keylogger 0x7cf60:$hawkstr1: HawkEye Keylogger 0x7d28f:$hawkstr1: HawkEye Keylogger 0x7d3ea:$hawkstr1: HawkEye Keylogger 0x7d54d:$hawkstr1: HawkEye Keylogger 0x7d7c6:$hawkstr1: HawkEye Keylogger 0x7bcad:$hawkstr2: Dear HawkEye Customers! 0x7d2e2:$hawkstr2: Dear HawkEye Customers! 0x7d439:$hawkstr2: Dear HawkEye Customers! 0x7d5a0:$hawkstr2: Dear HawkEye Customers! 0x7bdce:$hawkstr3: HawkEye Logger Details:
00000004.00000003.249596324.0000000001293000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.489137354.0000000000672000.00000002.00020000.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6c7:$key: HawkEyeKeylogger 0x7d90b:$salt: 099u787978786 0x7bd08:$string1: HawkEye_Keylogger 0x7cb5b:$string1: HawkEye_Keylogger 0x7d86b:$string1: HawkEye_Keylogger 0x7c0f1:$string2: holdermail.txt 0x7c111:$string2: holdermail.txt 0x7c033:$string3: wallet.dat 0x7c04b:$string3: wallet.dat 0x7c061:$string3: wallet.dat 0x7d42f:$string4: Keylog Records 0x7d747:$string4: Keylog Records 0x7d963:$string5: do not script --> 0x7b6af:$string6: \pidloc.txt 0x7b73d:$string7: BSPLIT 0x7b74d:$string7: BSPLIT
00000006.00000002.489137354.0000000000672000.00000002.00020000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000006.00000002.489137354.0000000000672000.00000002.00020000.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000006.00000002.489137354.0000000000672000.00000002.00020000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000006.00000002.489137354.0000000000672000.00000002.00020000.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd60:$hawkstr1: HawkEye Keylogger 0x7cba1:$hawkstr1: HawkEye Keylogger 0x7ced0:$hawkstr1: HawkEye Keylogger 0x7d02b:$hawkstr1: HawkEye Keylogger 0x7d18e:$hawkstr1: HawkEye Keylogger 0x7d407:$hawkstr1: HawkEye Keylogger 0x7b8ee:$hawkstr2: Dear HawkEye Customers! 0x7cf23:$hawkstr2: Dear HawkEye Customers! 0x7d07a:$hawkstr2: Dear HawkEye Customers! 0x7d1e1:$hawkstr2: Dear HawkEye Customers! 0x7ba0f:$hawkstr3: HawkEye Logger Details:
00000009.00000000.253083713.0000000000322000.00000002.00020000.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000004.00000003.254611636.0000000003BAB000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000003.255709181.0000000003E51000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000021.00000003.392335998.0000000003CF1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000003.249733611.0000000003BAB000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000021.00000002.419539821.0000000000403000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7ba86:$key: HawkEyeKeylogger 0x7dcca:$salt: 099u787978786 0x7c0c7:$string1: HawkEye_Keylogger 0x7cf1a:$string1: HawkEye_Keylogger 0x7dc2a:$string1: HawkEye_Keylogger 0x7c4b0:$string2: holdermail.txt 0x7c4d0:$string2: holdermail.txt 0x7c3f2:$string3: wallet.dat 0x7c40a:$string3: wallet.dat 0x7c420:$string3: wallet.dat 0x7d7ee:$string4: Keylog Records 0x7db06:$string4: Keylog Records 0x7dd22:$string5: do not script --> 0x7ba6e:$string6: \pidloc.txt 0x7bafc:$string7: BSPLIT 0x7bb0c:$string7: BSPLIT
00000021.00000002.419539821.0000000000403000.00000040.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000021.00000002.419539821.0000000000403000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000021.00000002.419539821.0000000000403000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000021.00000002.419539821.0000000000403000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000021.00000002.419539821.0000000000403000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c11f:$hawkstr1: HawkEye Keylogger 0x7cf60:$hawkstr1: HawkEye Keylogger 0x7d28f:$hawkstr1: HawkEye Keylogger 0x7d3ea:$hawkstr1: HawkEye Keylogger 0x7d54d:$hawkstr1: HawkEye Keylogger 0x7d7c6:$hawkstr1: HawkEye Keylogger 0x7bcad:$hawkstr2: Dear HawkEye Customers! 0x7d2e2:$hawkstr2: Dear HawkEye Customers! 0x7d439:$hawkstr2: Dear HawkEye Customers! 0x7d5a0:$hawkstr2: Dear HawkEye Customers! 0x7bdce:$hawkstr3: HawkEye Logger Details:
00000021.00000003.397781851.0000000003D5B000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000003.251501400.0000000001293000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000026.00000000.405296344.00000000006E2000.00000002.00020000.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
0000000A.00000000.254178193.0000000000682000.00000002.00020000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.427828296.00000000000F2000.00000002.00020000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000021.00000003.385572050.0000000003750000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b902:$key: HawkEyeKeylogger 0x7db46:$salt: 099u787978786 0x7bf43:$string1: HawkEye_Keylogger 0x7cd96:$string1: HawkEye_Keylogger 0x7daa6:$string1: HawkEye_Keylogger 0x7c32c:$string2: holdermail.txt 0x7c34c:$string2: holdermail.txt 0x7c26e:$string3: wallet.dat 0x7c286:$string3: wallet.dat 0x7c29c:$string3: wallet.dat 0x7d66a:$string4: Keylog Records 0x7d982:$string4: Keylog Records 0x7db9e:$string5: do not script --> 0x7b8ea:$string6: \pidloc.txt 0x7b978:$string7: BSPLIT 0x7b988:$string7: BSPLIT
00000021.00000003.385572050.0000000003750000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000021.00000003.385572050.0000000003750000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000021.00000003.385572050.0000000003750000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000021.00000003.385572050.0000000003750000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000021.00000003.385572050.0000000003750000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf9b:$hawkstr1: HawkEye Keylogger 0x7cddc:$hawkstr1: HawkEye Keylogger 0x7d10b:$hawkstr1: HawkEye Keylogger 0x7d266:$hawkstr1: HawkEye Keylogger 0x7d3c9:$hawkstr1: HawkEye Keylogger 0x7d642:$hawkstr1: HawkEye Keylogger 0x7bb29:$hawkstr2: Dear HawkEye Customers! 0x7d15e:$hawkstr2: Dear HawkEye Customers! 0x7d2b5:$hawkstr2: Dear HawkEye Customers! 0x7d41c:$hawkstr2: Dear HawkEye Customers! 0x7bc4a:$hawkstr3: HawkEye Logger Details:
00000006.00000002.520422224.0000000007DF0000.00000004.00000001.sdmp	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
00000021.00000003.402832252.0000000003D5B000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000021.00000003.388318104.0000000001453000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000024.00000000.396471028.00000000003D2000.00000002.00020000.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6c7:$key: HawkEyeKeylogger 0x7d90b:$salt: 099u787978786 0x7bd08:$string1: HawkEye_Keylogger 0x7cb5b:$string1: HawkEye_Keylogger 0x7d86b:$string1: HawkEye_Keylogger 0x7c0f1:$string2: holdermail.txt 0x7c111:$string2: holdermail.txt 0x7c033:$string3: wallet.dat 0x7c04b:$string3: wallet.dat 0x7c061:$string3: wallet.dat 0x7d42f:$string4: Keylog Records 0x7d747:$string4: Keylog Records 0x7d963:$string5: do not script --> 0x7b6af:$string6: \pidloc.txt 0x7b73d:$string7: BSPLIT 0x7b74d:$string7: BSPLIT
00000024.00000000.396471028.00000000003D2000.00000002.00020000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000024.00000000.396471028.00000000003D2000.00000002.00020000.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000024.00000000.396471028.00000000003D2000.00000002.00020000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000024.00000000.396471028.00000000003D2000.00000002.00020000.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd60:$hawkstr1: HawkEye Keylogger 0x7cba1:$hawkstr1: HawkEye Keylogger 0x7ced0:$hawkstr1: HawkEye Keylogger 0x7d02b:$hawkstr1: HawkEye Keylogger 0x7d18e:$hawkstr1: HawkEye Keylogger 0x7d407:$hawkstr1: HawkEye Keylogger 0x7b8ee:$hawkstr2: Dear HawkEye Customers! 0x7cf23:$hawkstr2: Dear HawkEye Customers! 0x7d07a:$hawkstr2: Dear HawkEye Customers! 0x7d1e1:$hawkstr2: Dear HawkEye Customers! 0x7ba0f:$hawkstr3: HawkEye Logger Details:
00000024.00000002.403481991.00000000003D2000.00000002.00020000.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6c7:$key: HawkEyeKeylogger 0x7d90b:$salt: 099u787978786 0x7bd08:$string1: HawkEye_Keylogger 0x7cb5b:$string1: HawkEye_Keylogger 0x7d86b:$string1: HawkEye_Keylogger 0x7c0f1:$string2: holdermail.txt 0x7c111:$string2: holdermail.txt 0x7c033:$string3: wallet.dat 0x7c04b:$string3: wallet.dat 0x7c061:$string3: wallet.dat 0x7d42f:$string4: Keylog Records 0x7d747:$string4: Keylog Records 0x7d963:$string5: do not script --> 0x7b6af:$string6: \pidloc.txt 0x7b73d:$string7: BSPLIT 0x7b74d:$string7: BSPLIT
00000024.00000002.403481991.00000000003D2000.00000002.00020000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000024.00000002.403481991.00000000003D2000.00000002.00020000.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000024.00000002.403481991.00000000003D2000.00000002.00020000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000024.00000002.403481991.00000000003D2000.00000002.00020000.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd60:$hawkstr1: HawkEye Keylogger 0x7cba1:$hawkstr1: HawkEye Keylogger 0x7ced0:$hawkstr1: HawkEye Keylogger 0x7d02b:$hawkstr1: HawkEye Keylogger 0x7d18e:$hawkstr1: HawkEye Keylogger 0x7d407:$hawkstr1: HawkEye Keylogger 0x7b8ee:$hawkstr2: Dear HawkEye Customers! 0x7cf23:$hawkstr2: Dear HawkEye Customers! 0x7d07a:$hawkstr2: Dear HawkEye Customers! 0x7d1e1:$hawkstr2: Dear HawkEye Customers! 0x7ba0f:$hawkstr3: HawkEye Logger Details:
00000001.00000002.361141701.0000000004154000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7d1b6:$key: HawkEyeKeylogger 0x1e01e6:$key: HawkEyeKeylogger 0x341216:$key: HawkEyeKeylogger 0x7f3fa:$salt: 099u787978786 0x1e242a:$salt: 099u787978786 0x34345a:$salt: 099u787978786 0x7d7f7:$string1: HawkEye_Keylogger 0x7e64a:$string1: HawkEye_Keylogger 0x7f35a:$string1: HawkEye_Keylogger 0x1e0827:$string1: HawkEye_Keylogger 0x1e167a:$string1: HawkEye_Keylogger 0x1e238a:$string1: HawkEye_Keylogger 0x341857:$string1: HawkEye_Keylogger 0x3426aa:$string1: HawkEye_Keylogger 0x3433ba:$string1: HawkEye_Keylogger 0x7dbe0:$string2: holdermail.txt 0x7dc00:$string2: holdermail.txt 0x1e0c10:$string2: holdermail.txt 0x1e0c30:$string2: holdermail.txt 0x341c40:$string2: holdermail.txt 0x341c60:$string2: holdermail.txt
00000001.00000002.361141701.0000000004154000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000001.00000002.361141701.0000000004154000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.361141701.0000000004154000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000002.361141701.0000000004154000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000021.00000003.399192472.0000000003940000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000001.00000002.361141701.0000000004154000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7d84f:$hawkstr1: HawkEye Keylogger 0x7e690:$hawkstr1: HawkEye Keylogger 0x7e9bf:$hawkstr1: HawkEye Keylogger 0x7eb1a:$hawkstr1: HawkEye Keylogger 0x7ec7d:$hawkstr1: HawkEye Keylogger 0x7eef6:$hawkstr1: HawkEye Keylogger 0x1e087f:$hawkstr1: HawkEye Keylogger 0x1e16c0:$hawkstr1: HawkEye Keylogger 0x1e19ef:$hawkstr1: HawkEye Keylogger 0x1e1b4a:$hawkstr1: HawkEye Keylogger 0x1e1cad:$hawkstr1: HawkEye Keylogger 0x1e1f26:$hawkstr1: HawkEye Keylogger 0x3418af:$hawkstr1: HawkEye Keylogger 0x3426f0:$hawkstr1: HawkEye Keylogger 0x342a1f:$hawkstr1: HawkEye Keylogger 0x342b7a:$hawkstr1: HawkEye Keylogger 0x342cdd:$hawkstr1: HawkEye Keylogger 0x342f56:$hawkstr1: HawkEye Keylogger 0x7d3dd:$hawkstr2: Dear HawkEye Customers! 0x7ea12:$hawkstr2: Dear HawkEye Customers! 0x7eb69:$hawkstr2: Dear HawkEye Customers!
00000021.00000003.412233865.000000000405D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000021.00000003.397017946.0000000001453000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.445240887.0000000002501000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.445240887.0000000002501000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.448946669.0000000002E51000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.448946669.0000000002E51000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.246897806.0000000001293000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000021.00000003.415754718.0000000001453000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000003.246965930.0000000003B41000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001E.00000002.638917740.0000000003D14000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x1e01e6:$key: HawkEyeKeylogger 0x341216:$key: HawkEyeKeylogger 0x4a0236:$key: HawkEyeKeylogger 0x1e242a:$salt: 099u787978786 0x34345a:$salt: 099u787978786 0x4a247a:$salt: 099u787978786 0x1e0827:$string1: HawkEye_Keylogger 0x1e167a:$string1: HawkEye_Keylogger 0x1e238a:$string1: HawkEye_Keylogger 0x341857:$string1: HawkEye_Keylogger 0x3426aa:$string1: HawkEye_Keylogger 0x3433ba:$string1: HawkEye_Keylogger 0x4a0877:$string1: HawkEye_Keylogger 0x4a16ca:$string1: HawkEye_Keylogger 0x4a23da:$string1: HawkEye_Keylogger 0x1e0c10:$string2: holdermail.txt 0x1e0c30:$string2: holdermail.txt 0x341c40:$string2: holdermail.txt 0x341c60:$string2: holdermail.txt 0x4a0c60:$string2: holdermail.txt 0x4a0c80:$string2: holdermail.txt
0000001E.00000002.638917740.0000000003D14000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
0000001E.00000002.638917740.0000000003D14000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000001E.00000002.638917740.0000000003D14000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000001E.00000002.638917740.0000000003D14000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000001E.00000002.638917740.0000000003D14000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x1e087f:$hawkstr1: HawkEye Keylogger 0x1e16c0:$hawkstr1: HawkEye Keylogger 0x1e19ef:$hawkstr1: HawkEye Keylogger 0x1e1b4a:$hawkstr1: HawkEye Keylogger 0x1e1cad:$hawkstr1: HawkEye Keylogger 0x1e1f26:$hawkstr1: HawkEye Keylogger 0x3418af:$hawkstr1: HawkEye Keylogger 0x3426f0:$hawkstr1: HawkEye Keylogger 0x342a1f:$hawkstr1: HawkEye Keylogger 0x342b7a:$hawkstr1: HawkEye Keylogger 0x342cdd:$hawkstr1: HawkEye Keylogger 0x342f56:$hawkstr1: HawkEye Keylogger 0x4a08cf:$hawkstr1: HawkEye Keylogger 0x4a1710:$hawkstr1: HawkEye Keylogger 0x4a1a3f:$hawkstr1: HawkEye Keylogger 0x4a1b9a:$hawkstr1: HawkEye Keylogger 0x4a1cfd:$hawkstr1: HawkEye Keylogger 0x4a1f76:$hawkstr1: HawkEye Keylogger 0x1e040d:$hawkstr2: Dear HawkEye Customers! 0x1e1a42:$hawkstr2: Dear HawkEye Customers! 0x1e1b99:$hawkstr2: Dear HawkEye Customers!
00000004.00000003.251891646.0000000003BAB000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000021.00000003.400705321.0000000003940000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000021.00000003.391416001.0000000003C10000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000006.00000002.498581730.0000000002E11000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x2c400:$key: HawkEyeKeylogger 0x2d1f4:$salt: 099u787978786 0x4204c:$string1: HawkEye_Keylogger 0x4739c:$string1: HawkEye_Keylogger 0x44f7c:$string2: holdermail.txt 0x44fac:$string2: holdermail.txt 0x42bde:$string3: wallet.dat 0x42c06:$string3: wallet.dat 0x42c2c:$string3: wallet.dat 0x4428c:$string4: Keylog Records 0x445c2:$string4: Keylog Records 0x31ebc:$string5: do not script --> 0x2c3d8:$string6: \pidloc.txt 0x2c4e0:$string7: BSPLIT 0x2c500:$string7: BSPLIT
00000006.00000002.498581730.0000000002E11000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000006.00000002.498581730.0000000002E11000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x420dc:$hawkstr1: HawkEye Keylogger 0x42cb0:$hawkstr1: HawkEye Keylogger 0x43048:$hawkstr1: HawkEye Keylogger 0x44264:$hawkstr1: HawkEye Keylogger 0x473f4:$hawkstr1: HawkEye Keylogger 0x4b2b4:$hawkstr1: HawkEye Keylogger 0x41b54:$hawkstr2: Dear HawkEye Customers! 0x42d14:$hawkstr2: Dear HawkEye Customers! 0x430ac:$hawkstr2: Dear HawkEye Customers! 0x4b314:$hawkstr2: Dear HawkEye Customers! 0x41c86:$hawkstr3: HawkEye Logger Details:
Process Memory Space: origigoods20.exe PID: 5580	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: origigoods20.exe PID: 5580	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 6896	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Orders.exe PID: 6824	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
Process Memory Space: Orders.exe PID: 6824	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: Orders.exe PID: 6824	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: Orders.exe PID: 6824	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: origigoods40.exe PID: 7116	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: origigoods40.exe PID: 7116	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 106 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.0.origigoods20.exe.680000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.0.hawkgoods.exe.670000.0.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
6.0.hawkgoods.exe.670000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c7:$key: HawkEyeKeylogger 0x7db0b:$salt: 099u787978786 0x7bf08:$string1: HawkEye_Keylogger 0x7cd5b:$string1: HawkEye_Keylogger 0x7da6b:$string1: HawkEye_Keylogger 0x7c2f1:$string2: holdermail.txt 0x7c311:$string2: holdermail.txt 0x7c233:$string3: wallet.dat 0x7c24b:$string3: wallet.dat 0x7c261:$string3: wallet.dat 0x7d62f:$string4: Keylog Records 0x7d947:$string4: Keylog Records 0x7db63:$string5: do not script --> 0x7b8af:$string6: \pidloc.txt 0x7b93d:$string7: BSPLIT 0x7b94d:$string7: BSPLIT
6.0.hawkgoods.exe.670000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
6.0.hawkgoods.exe.670000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
6.0.hawkgoods.exe.670000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
6.0.hawkgoods.exe.670000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf60:$hawkstr1: HawkEye Keylogger 0x7cda1:$hawkstr1: HawkEye Keylogger 0x7d0d0:$hawkstr1: HawkEye Keylogger 0x7d22b:$hawkstr1: HawkEye Keylogger 0x7d38e:$hawkstr1: HawkEye Keylogger 0x7d607:$hawkstr1: HawkEye Keylogger 0x7baee:$hawkstr2: Dear HawkEye Customers! 0x7d123:$hawkstr2: Dear HawkEye Customers! 0x7d27a:$hawkstr2: Dear HawkEye Customers! 0x7d3e1:$hawkstr2: Dear HawkEye Customers! 0x7bc0f:$hawkstr3: HawkEye Logger Details:
39.0.origigoods20.exe.530000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
37.0.origigoods40.exe.e70000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.origigoods40.exe.f0000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.hawkgoods.exe.7da0000.3.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
36.0.hawkgoods.exe.3d0000.0.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
36.0.hawkgoods.exe.3d0000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c7:$key: HawkEyeKeylogger 0x7db0b:$salt: 099u787978786 0x7bf08:$string1: HawkEye_Keylogger 0x7cd5b:$string1: HawkEye_Keylogger 0x7da6b:$string1: HawkEye_Keylogger 0x7c2f1:$string2: holdermail.txt 0x7c311:$string2: holdermail.txt 0x7c233:$string3: wallet.dat 0x7c24b:$string3: wallet.dat 0x7c261:$string3: wallet.dat 0x7d62f:$string4: Keylog Records 0x7d947:$string4: Keylog Records 0x7db63:$string5: do not script --> 0x7b8af:$string6: \pidloc.txt 0x7b93d:$string7: BSPLIT 0x7b94d:$string7: BSPLIT
36.0.hawkgoods.exe.3d0000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
36.0.hawkgoods.exe.3d0000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
36.0.hawkgoods.exe.3d0000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
36.0.hawkgoods.exe.3d0000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf60:$hawkstr1: HawkEye Keylogger 0x7cda1:$hawkstr1: HawkEye Keylogger 0x7d0d0:$hawkstr1: HawkEye Keylogger 0x7d22b:$hawkstr1: HawkEye Keylogger 0x7d38e:$hawkstr1: HawkEye Keylogger 0x7d607:$hawkstr1: HawkEye Keylogger 0x7baee:$hawkstr2: Dear HawkEye Customers! 0x7d123:$hawkstr2: Dear HawkEye Customers! 0x7d27a:$hawkstr2: Dear HawkEye Customers! 0x7d3e1:$hawkstr2: Dear HawkEye Customers! 0x7bc0f:$hawkstr3: HawkEye Logger Details:
8.0.origigoods40.exe.f0000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.hawkgoods.exe.7df0000.4.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
10.2.origigoods20.exe.680000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.hawkgoods.exe.670000.0.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
6.2.hawkgoods.exe.670000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c7:$key: HawkEyeKeylogger 0x7db0b:$salt: 099u787978786 0x7bf08:$string1: HawkEye_Keylogger 0x7cd5b:$string1: HawkEye_Keylogger 0x7da6b:$string1: HawkEye_Keylogger 0x7c2f1:$string2: holdermail.txt 0x7c311:$string2: holdermail.txt 0x7c233:$string3: wallet.dat 0x7c24b:$string3: wallet.dat 0x7c261:$string3: wallet.dat 0x7d62f:$string4: Keylog Records 0x7d947:$string4: Keylog Records 0x7db63:$string5: do not script --> 0x7b8af:$string6: \pidloc.txt 0x7b93d:$string7: BSPLIT 0x7b94d:$string7: BSPLIT
6.2.hawkgoods.exe.670000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
6.2.hawkgoods.exe.670000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
6.2.hawkgoods.exe.670000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
6.2.hawkgoods.exe.670000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf60:$hawkstr1: HawkEye Keylogger 0x7cda1:$hawkstr1: HawkEye Keylogger 0x7d0d0:$hawkstr1: HawkEye Keylogger 0x7d22b:$hawkstr1: HawkEye Keylogger 0x7d38e:$hawkstr1: HawkEye Keylogger 0x7d607:$hawkstr1: HawkEye Keylogger 0x7baee:$hawkstr2: Dear HawkEye Customers! 0x7d123:$hawkstr2: Dear HawkEye Customers! 0x7d27a:$hawkstr2: Dear HawkEye Customers! 0x7d3e1:$hawkstr2: Dear HawkEye Customers! 0x7bc0f:$hawkstr3: HawkEye Logger Details:
36.2.hawkgoods.exe.3d0000.0.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
36.2.hawkgoods.exe.3d0000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c7:$key: HawkEyeKeylogger 0x7db0b:$salt: 099u787978786 0x7bf08:$string1: HawkEye_Keylogger 0x7cd5b:$string1: HawkEye_Keylogger 0x7da6b:$string1: HawkEye_Keylogger 0x7c2f1:$string2: holdermail.txt 0x7c311:$string2: holdermail.txt 0x7c233:$string3: wallet.dat 0x7c24b:$string3: wallet.dat 0x7c261:$string3: wallet.dat 0x7d62f:$string4: Keylog Records 0x7d947:$string4: Keylog Records 0x7db63:$string5: do not script --> 0x7b8af:$string6: \pidloc.txt 0x7b93d:$string7: BSPLIT 0x7b94d:$string7: BSPLIT
36.2.hawkgoods.exe.3d0000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
36.2.hawkgoods.exe.3d0000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
36.2.hawkgoods.exe.3d0000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
36.2.hawkgoods.exe.3d0000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf60:$hawkstr1: HawkEye Keylogger 0x7cda1:$hawkstr1: HawkEye Keylogger 0x7d0d0:$hawkstr1: HawkEye Keylogger 0x7d22b:$hawkstr1: HawkEye Keylogger 0x7d38e:$hawkstr1: HawkEye Keylogger 0x7d607:$hawkstr1: HawkEye Keylogger 0x7baee:$hawkstr2: Dear HawkEye Customers! 0x7d123:$hawkstr2: Dear HawkEye Customers! 0x7d27a:$hawkstr2: Dear HawkEye Customers! 0x7d3e1:$hawkstr2: Dear HawkEye Customers! 0x7bc0f:$hawkstr3: HawkEye Logger Details:
38.0.Matiexgoods.exe.6e0000.0.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
9.0.Matiexgoods.exe.320000.0.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.2.RegAsm.exe.400000.0.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x990e:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
4.2.RegAsm.exe.400000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7ddb2:$key: HawkEyeKeylogger 0x7fff6:$salt: 099u787978786 0x7e3f3:$string1: HawkEye_Keylogger 0x7f246:$string1: HawkEye_Keylogger 0x7ff56:$string1: HawkEye_Keylogger 0x7e7dc:$string2: holdermail.txt 0x7e7fc:$string2: holdermail.txt 0x7e71e:$string3: wallet.dat 0x7e736:$string3: wallet.dat 0x7e74c:$string3: wallet.dat 0x7fb1a:$string4: Keylog Records 0x7fe32:$string4: Keylog Records 0x8004e:$string5: do not script --> 0x7dd9a:$string6: \pidloc.txt 0x7de28:$string7: BSPLIT 0x7de38:$string7: BSPLIT
4.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
4.2.RegAsm.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
4.2.RegAsm.exe.400000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
4.2.RegAsm.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
33.2.RegAsm.exe.400000.0.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x990e:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
33.2.RegAsm.exe.400000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7ddb2:$key: HawkEyeKeylogger 0x7fff6:$salt: 099u787978786 0x7e3f3:$string1: HawkEye_Keylogger 0x7f246:$string1: HawkEye_Keylogger 0x7ff56:$string1: HawkEye_Keylogger 0x7e7dc:$string2: holdermail.txt 0x7e7fc:$string2: holdermail.txt 0x7e71e:$string3: wallet.dat 0x7e736:$string3: wallet.dat 0x7e74c:$string3: wallet.dat 0x7fb1a:$string4: Keylog Records 0x7fe32:$string4: Keylog Records 0x8004e:$string5: do not script --> 0x7dd9a:$string6: \pidloc.txt 0x7de28:$string7: BSPLIT 0x7de38:$string7: BSPLIT
33.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
33.2.RegAsm.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
33.2.RegAsm.exe.400000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
33.2.RegAsm.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
33.2.RegAsm.exe.400000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7e44b:$hawkstr1: HawkEye Keylogger 0x7f28c:$hawkstr1: HawkEye Keylogger 0x7f5bb:$hawkstr1: HawkEye Keylogger 0x7f716:$hawkstr1: HawkEye Keylogger 0x7f879:$hawkstr1: HawkEye Keylogger 0x7faf2:$hawkstr1: HawkEye Keylogger 0x7dfd9:$hawkstr2: Dear HawkEye Customers! 0x7f60e:$hawkstr2: Dear HawkEye Customers! 0x7f765:$hawkstr2: Dear HawkEye Customers! 0x7f8cc:$hawkstr2: Dear HawkEye Customers! 0x7e0fa:$hawkstr3: HawkEye Logger Details:
4.2.RegAsm.exe.400000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7e44b:$hawkstr1: HawkEye Keylogger 0x7f28c:$hawkstr1: HawkEye Keylogger 0x7f5bb:$hawkstr1: HawkEye Keylogger 0x7f716:$hawkstr1: HawkEye Keylogger 0x7f879:$hawkstr1: HawkEye Keylogger 0x7faf2:$hawkstr1: HawkEye Keylogger 0x7dfd9:$hawkstr2: Dear HawkEye Customers! 0x7f60e:$hawkstr2: Dear HawkEye Customers! 0x7f765:$hawkstr2: Dear HawkEye Customers! 0x7f8cc:$hawkstr2: Dear HawkEye Customers! 0x7e0fa:$hawkstr3: HawkEye Logger Details:
Click to see the 43 entries

Sigma Overview

System Summary:

Sigma detected: Capture Wi-Fi password

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'netsh' wlan show profile, CommandLine: 'netsh' wlan show profile, CommandLine|base64offset|contains: V, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: 'C:\Users\user~1\AppData\Local\Temp\Matiexgoods.exe' 0, ParentImage: C:\Users\user\AppData\Local\Temp\Matiexgoods.exe, ParentProcessId: 7148, ProcessCommandLine: 'netsh' wlan show profile, ProcessId: 6780

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\hawkgoods.exe	Avira: detection malicious, Label: TR/AD.MExecute.lzrac
Source: C:\Users\user\AppData\Local\Temp\hawkgoods.exe	Avira: detection malicious, Label: SPR/Tool.MailPassView.473
Source: C:\Users\user\AppData\Local\Temp\origigoods40.exe	Avira: detection malicious, Label: TR/Spy.Gen8
Source: C:\Users\user\AppData\Local\Temp\Matiexgoods.exe	Avira: detection malicious, Label: TR/Redcap.jajcu
Source: C:\Users\user\AppData\Local\Temp\origigoods20.exe	Avira: detection malicious, Label: TR/Spy.Gen8

Found malware configuration

Show sources

Source: origigoods20.exe.5580.10.memstr	Malware Configuration Extractor: Agenttesla {"Username: ": "", "URL: ": "", "To: ": "sales1@midombo.com", "ByHost: ": "smtp.privateemail.com:587", "Password: ": "", "From: ": "sales1@midombo.com"}
Source: Orders.exe.6824.1.memstr	Malware Configuration Extractor: HawkEye {"Modules": ["WebBrowserPassView", "mailpv", "Mail PassView"], "Version": ""}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\Matiexgoods.exe	Metadefender: Detection: 43%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\Matiexgoods.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\hawkgoods.exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Temp\origigoods20.exe	Metadefender: Detection: 40%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\origigoods20.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\origigoods40.exe	Metadefender: Detection: 37%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\origigoods40.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe	ReversingLabs: Detection: 22%

Multi AV Scanner detection for submitted file

Show sources

Source: Orders.exe

ReversingLabs: Detection: 22%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\hawkgoods.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\origigoods40.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Matiexgoods.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\origigoods20.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: Orders.exe

Joe Sandbox ML: detected

Source: 6.0.hawkgoods.exe.670000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 6.0.hawkgoods.exe.670000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 36.0.hawkgoods.exe.3d0000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 36.0.hawkgoods.exe.3d0000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 38.0.Matiexgoods.exe.6e0000.0.unpack	Avira: Label: TR/Redcap.jajcu
Source: 33.2.RegAsm.exe.400000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 33.2.RegAsm.exe.400000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 33.2.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Redcap.jajcu
Source: 33.2.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.2.RegAsm.exe.400000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 4.2.RegAsm.exe.400000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 4.2.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Redcap.jajcu
Source: 4.2.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 9.0.Matiexgoods.exe.320000.0.unpack	Avira: Label: TR/Redcap.jajcu
Source: 6.2.hawkgoods.exe.670000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 6.2.hawkgoods.exe.670000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 36.2.hawkgoods.exe.3d0000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 36.2.hawkgoods.exe.3d0000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473

Compliance:

Uses 32bit PE files

Show sources

Source: Orders.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Uses insecure TLS / SSL version for HTTPS connection

Show sources

Source: unknown	HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.7:49727 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.7:49795 version: TLS 1.0

Uses new MSVCR Dlls

Show sources

Source: C:\Users\user\AppData\Local\Temp\hawkgoods.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: Orders.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Show sources

Source:	Binary string: crypt32.pdbPq source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: System.Data.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdbk source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdb% source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdbx source: WerFault.exe, 0000000B.00000002.341129759.0000000005510000.00000004.00000001.sdmp
Source:	Binary string: System.Runtime.Remoting.pdbmoting.pdbpdbing.pdbg\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.pdb source: hawkgoods.exe, 00000006.00000002.521259044.000000000850B000.00000004.00000010.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000B.00000003.261989055.0000000003001000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.304085639.0000000004D25000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb~q source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000B.00000003.283061091.0000000005290000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: NapiNSP.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000B.00000003.282843528.00000000052C1000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\symbols\dll\System.Runtime.Remoting.pdb source: hawkgoods.exe, 00000006.00000002.495362549.0000000002ACC000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdbYnL source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000B.00000003.264528925.0000000002FF5000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.304143187.0000000002D30000.00000004.00000001.sdmp
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdb2.0.0.0__b77a5c561934e089\mscorlib.pdb source: hawkgoods.exe, 00000006.00000002.519656085.0000000007A0A000.00000004.00000010.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: .pdb%H source: Orders.exe, 00000001.00000002.347167412.0000000000EF8000.00000004.00000010.sdmp
Source:	Binary string: wwin32u.pdbdq source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000B.00000003.282843528.00000000052C1000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000B.00000003.282843528.00000000052C1000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.pdbu source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WerFault.exe, 0000000B.00000003.282528294.00000000052A4000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdbrq source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb source: Orders.exe, 00000001.00000002.361141701.0000000004154000.00000004.00000001.sdmp, RegAsm.exe, 00000004.00000003.246774488.0000000003670000.00000004.00000001.sdmp, hawkgoods.exe
Source:	Binary string: @Cosymbols\dll\System.Runtime.Remoting.pdb source: hawkgoods.exe, 00000006.00000002.521259044.000000000850B000.00000004.00000010.sdmp
Source:	Binary string: f:\Projects\VS2005\mailpv\Release\mailpv.pdb source: Orders.exe, 00000001.00000002.361141701.0000000004154000.00000004.00000001.sdmp, RegAsm.exe, 00000004.00000003.246774488.0000000003670000.00000004.00000001.sdmp, hawkgoods.exe
Source:	Binary string: System.Xml.pdbx source: WerFault.exe, 0000000B.00000002.341129759.0000000005510000.00000004.00000001.sdmp
Source:	Binary string: i.pdb source: WerFault.exe, 0000000B.00000003.282528294.00000000052A4000.00000004.00000001.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: D:\Before FprmT\Document VB project\FireFox Stub\FireFox Stub\obj\Debug\VNXT.pdb source: Orders.exe, 00000001.00000002.361141701.0000000004154000.00000004.00000001.sdmp, RegAsm.exe, 00000004.00000002.256501427.0000000000403000.00000040.00000001.sdmp, Matiexgoods.exe, 00000009.00000000.253083713.0000000000322000.00000002.00020000.sdmp
Source:	Binary string: ole32.pdb(q source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: C:\Users\user\Desktop\Orders.PDB source: Orders.exe, 00000001.00000002.347167412.0000000000EF8000.00000004.00000010.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdb;nb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbk source: WerFault.exe, 0000000B.00000003.282899730.0000000005294000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: f:\binaries.x86ret\bin\i386\bbt\opt\bin\i386\diasymreader.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: pnrpnsp.pdbCnJ source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdbo source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdbx source: WerFault.exe, 0000000B.00000002.341129759.0000000005510000.00000004.00000001.sdmp
Source:	Binary string: msasn1.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.pdb source: hawkgoods.exe, 00000006.00000002.495266198.0000000002AC7000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000002.341129759.0000000005510000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000B.00000003.282899730.0000000005294000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000000B.00000003.261989055.0000000003001000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.307051340.0000000002D3C000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000B.00000003.282843528.00000000052C1000.00000004.00000001.sdmp
Source:	Binary string: System.Runtime.Remoting.pdbcal\Temp\hawkgoods.exeAAX source: hawkgoods.exe, 00000006.00000002.495266198.0000000002AC7000.00000004.00000040.sdmp
Source:	Binary string: rasadhlp.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: Orders.PDB source: Orders.exe, 00000001.00000002.347167412.0000000000EF8000.00000004.00000010.sdmp
Source:	Binary string: advapi32.pdbk source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: System.Data.DataSetExtensions.pdbx source: WerFault.exe, 0000000B.00000002.341129759.0000000005510000.00000004.00000001.sdmp
Source:	Binary string: RunPE.pdb source: Orders.exe, 00000001.00000002.357040071.0000000002FFB000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000002.341129759.0000000005510000.00000004.00000001.sdmp
Source:	Binary string: cfgmgr32.pdb<q source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.pdb>> source: WerFault.exe, 0000000B.00000003.282528294.00000000052A4000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: oC:\Windows\mscorlib.pdb source: hawkgoods.exe, 00000006.00000002.519656085.0000000007A0A000.00000004.00000010.sdmp
Source:	Binary string: System.Core.ni.pdb" source: WerFault.exe, 0000000B.00000003.282528294.00000000052A4000.00000004.00000001.sdmp
Source:	Binary string: mscorlib.pdb%o source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: System.Core.ni.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: msvcr80.i386.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb#o source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: f:\binaries.x86ret\bin\i386\bbt\opt\bin\i386\diasymreader.pdb_ source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: rasapi32.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdbT source: WerFault.exe, 0000000B.00000002.341129759.0000000005510000.00000004.00000001.sdmp
Source:	Binary string: diasymreader.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: i.pdb" source: WerFault.exe, 0000000B.00000003.282528294.00000000052A4000.00000004.00000001.sdmp
Source:	Binary string: System.pdbu source: WerFault.exe, 0000000B.00000003.282528294.00000000052A4000.00000004.00000001.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: wmiutils.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: hawkgoods.exe, 00000006.00000002.492246484.0000000000D40000.00000004.00000020.sdmp
Source:	Binary string: System.pdbx source: WerFault.exe, 0000000B.00000002.341129759.0000000005510000.00000004.00000001.sdmp
Source:	Binary string: mscorlib.pdbHs source: hawkgoods.exe, 00000006.00000002.519656085.0000000007A0A000.00000004.00000010.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000B.00000003.283061091.0000000005290000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: mscorjit.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000B.00000003.282843528.00000000052C1000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb.q source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: System.Runtime.Remoting.pdb0\| source: hawkgoods.exe, 00000006.00000002.495362549.0000000002ACC000.00000004.00000040.sdmp
Source:	Binary string: msvcr120_clr0400.i386.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: fastprox.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: wbemsvc.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: winrnr.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.pdb source: WerFault.exe, 0000000B.00000003.282528294.00000000052A4000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: i0C:\Windows\mscorlib.pdb source: Orders.exe, 00000001.00000002.347167412.0000000000EF8000.00000004.00000010.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WerFault.exe, 0000000B.00000003.282528294.00000000052A4000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: System.Core.pdb"" source: WerFault.exe, 0000000B.00000003.282528294.00000000052A4000.00000004.00000001.sdmp
Source:	Binary string: fwpuclnt.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000B.00000003.282564070.0000000005291000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbk source: WerFault.exe, 0000000B.00000003.282899730.0000000005294000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbVq source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: System.Windows.Forms.pdbx source: WerFault.exe, 0000000B.00000002.341129759.0000000005510000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdbk source: WerFault.exe, 0000000B.00000003.282564070.0000000005291000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb" source: WerFault.exe, 0000000B.00000003.282528294.00000000052A4000.00000004.00000001.sdmp
Source:	Binary string: System.Xml.ni.pdb% source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: clrjit.pdbxq source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdb" source: WerFault.exe, 0000000B.00000003.282528294.00000000052A4000.00000004.00000001.sdmp
Source:	Binary string: System.ni.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdbk source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: rsaenh.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\System.Runtime.Remoting.pdb source: hawkgoods.exe, 00000006.00000002.495362549.0000000002ACC000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc.pdb=nh source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: wbemcomn.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000B.00000003.282843528.00000000052C1000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: clr.pdb source: WerFault.exe, 0000000B.00000003.283061091.0000000005290000.00000004.00000040.sdmp
Source:	Binary string: CLBCatQ.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb/o source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000B.00000003.262032380.0000000003007000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000000B.00000003.282899730.0000000005294000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: mscorjit.pdbs source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb0q source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdbx source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: System.Windows.Forms.pdb7 source: WerFault.exe, 0000000B.00000003.282528294.00000000052A4000.00000004.00000001.sdmp
Source:	Binary string: powrprof.pdb6q source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: wintrust.pdbq source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: mscoree.pdb source: WerFault.exe, 0000000B.00000003.282843528.00000000052C1000.00000004.00000001.sdmp
Source:	Binary string: oC:\Windows\System.Runtime.Remoting.pdb source: hawkgoods.exe, 00000006.00000002.521259044.000000000850B000.00000004.00000010.sdmp
Source:	Binary string: System.pdb7o source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: symbols\dll\mscorlib.pdb source: hawkgoods.exe, 00000006.00000002.519656085.0000000007A0A000.00000004.00000010.sdmp
Source:	Binary string: WLDP.pdbjq source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdbW source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: D:\Before FprmT\Document VB project\FireFox Stub\FireFox Stub\obj\Debug\VNXT.pdbh} source: Orders.exe, 00000001.00000002.361141701.0000000004154000.00000004.00000001.sdmp, RegAsm.exe, 00000004.00000002.256501427.0000000000403000.00000040.00000001.sdmp, Matiexgoods.exe, 00000009.00000000.253083713.0000000000322000.00000002.00020000.sdmp
Source:	Binary string: msvcr120_clr0400.i386.pdbP source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdbN source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdbP source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: DWrite.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: System.Drawing.pdb source: WerFault.exe, 0000000B.00000002.341129759.0000000005510000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdbknR source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: System.Management.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: System.Data.DataSetExtensions.pdb source: WerFault.exe, 0000000B.00000002.341129759.0000000005510000.00000004.00000001.sdmp
Source:	Binary string: C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.pdbd source: hawkgoods.exe, 00000006.00000002.495178056.0000000002AC0000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbmnX source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: rawing.pdb source: WerFault.exe, 0000000B.00000003.282528294.00000000052A4000.00000004.00000001.sdmp
Source:	Binary string: pnrpnsp.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: mscoreei.pdbk source: WerFault.exe, 0000000B.00000003.282899730.0000000005294000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.pdbx source: WerFault.exe, 0000000B.00000002.341129759.0000000005510000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000B.00000003.283061091.0000000005290000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: fastprox.pdb)n source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: version.pdb"q source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: nlaapi.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdb% source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: gdiplus.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdbEnp source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdbT3 source: WerFault.exe, 0000000B.00000002.341129759.0000000005510000.00000004.00000001.sdmp
Source:	Binary string: rtutils.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: edputil.pdbOn~ source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000000B.00000003.264528925.0000000002FF5000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.304143187.0000000002D30000.00000004.00000001.sdmp
Source:	Binary string: mscorwks.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: f:\binaries.x86ret\bin\i386\Microsoft.VisualBasic.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: indows\System.Runtime.Remoting.pdbpdbing.pdbd source: hawkgoods.exe, 00000006.00000002.495362549.0000000002ACC000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdbanT source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: WLDP.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\assembly\GA.pdbL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.d source: hawkgoods.exe, 00000006.00000002.521259044.000000000850B000.00000004.00000010.sdmp
Source:	Binary string: wUxTheme.pdb9o source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: clrjit.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: shfolder.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: rasman.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\dll\System.Runtime.Remoting.pdb source: hawkgoods.exe, 00000006.00000002.495362549.0000000002ACC000.00000004.00000040.sdmp
Source:	Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: Orders.exe, 00000001.00000002.361141701.0000000004154000.00000004.00000001.sdmp, RegAsm.exe, 00000004.00000003.246774488.0000000003670000.00000004.00000001.sdmp, hawkgoods.exe
Source:	Binary string: System.Runtime.Remoting.pdb source: hawkgoods.exe, 00000006.00000002.495362549.0000000002ACC000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: version.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdbMo source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: \??\C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.pdb source: hawkgoods.exe, 00000006.00000002.492246484.0000000000D40000.00000004.00000020.sdmp
Source:	Binary string: ata.DataSetExtensions.pdb source: WerFault.exe, 0000000B.00000003.282528294.00000000052A4000.00000004.00000001.sdmp
Source:	Binary string: psapi.pdb'n source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: wintrust.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: rasapi32.pdbWnF source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: System.pdb source: WerFault.exe, 0000000B.00000003.282528294.00000000052A4000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: mscorrc.pdb source: hawkgoods.exe, 00000006.00000002.506186983.0000000004FD0000.00000002.00000001.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000B.00000003.283061091.0000000005290000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: psapi.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: WMINet_Utils.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000B.00000003.282843528.00000000052C1000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: System.Core.pdbx source: WerFault.exe, 0000000B.00000002.341129759.0000000005510000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000B.00000003.262032380.0000000003007000.00000004.00000001.sdmp
Source:	Binary string: mscoreei.pdb source: WerFault.exe, 0000000B.00000003.282899730.0000000005294000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: System.Drawing.pdbx source: WerFault.exe, 0000000B.00000002.341129759.0000000005510000.00000004.00000001.sdmp
Source:	Binary string: C:\Windows\assembly\GA.pdbmscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll source: hawkgoods.exe, 00000006.00000002.519656085.0000000007A0A000.00000004.00000010.sdmp
Source:	Binary string: System.Core.pdb source: WerFault.exe, 0000000B.00000003.282528294.00000000052A4000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: wbemcomn.pdb1nd source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: wbemprox.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdb source: WerFault.exe, 0000000B.00000003.282657543.0000000005297000.00000004.00000040.sdmp
Source:	Binary string: edputil.pdb source: WerFault.exe, 00000017.00000003.343965279.00000000051E8000.00000004.00000040.sdmp

Spreading:

Source: Orders.exe, 00000001.00000002.361141701.0000000004154000.00000004.00000001.sdmp	Binary or memory string: autorun.inf
Source: Orders.exe, 00000001.00000002.361141701.0000000004154000.00000004.00000001.sdmp	Binary or memory string: [autorun]
Source: RegAsm.exe, 00000004.00000003.246774488.0000000003670000.00000004.00000001.sdmp	Binary or memory string: autorun.inf
Source: RegAsm.exe, 00000004.00000003.246774488.0000000003670000.00000004.00000001.sdmp	Binary or memory string: [autorun]
Source: hawkgoods.exe	Binary or memory string: autorun.inf
Source: hawkgoods.exe	Binary or memory string: [autorun]
Source: WerFault.exe, 00000017.00000002.450940492.0000000005360000.00000004.00000001.sdmp	Binary or memory string: autorun.inf
Source: WerFault.exe, 00000017.00000002.450940492.0000000005360000.00000004.00000001.sdmp	Binary or memory string: [autorun]

Software Vulnerabilities:

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Orders.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: HawkEye

Threatname: Agenttesla

Yara Overview

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Spreading:

Software Vulnerabilities: