cybergate | 3f7091c010cc92323b138ee8f1eeae07b94a4b60231a3ab555592da2513e4fc9

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5a52dae5071c83bd5d8d22f81ad948bf.exe
Size 581KB
Sample240114-few8hadch5
SHA256 3f7091c010cc92323b138ee8f1eeae07b94a4b60231a3ab555592da2513e4fc9
MD5 5a52dae5071c83bd5d8d22f81ad948bf
SHA1 005013dee49df222593e7ba7702a5eccd70eb4a4
SHA512 71ff7997397fd478884b426f0643fdcf0435fa22e047109890e0cf14486898a1ae5f8ba05d61ceb9c6f92584af4d35950491fade8fed2dab6c4483762ad5e148
SSDEEP 12288:50pfgdZwRu/RMF59vOZY8qPXBfAQ0tuzvK+ffWjo7U:CodZwMSPwrgXZmtuzvK+AD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate vítima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

Botnet

vítima

aqw123.myftp.org:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
Firefox.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Impossible d'executer ce logiciel sous cet version de Windows
message_box_title
Erreur
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	5a52dae5071c83bd5d8d22f81ad948bf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\Firefox.exe"	5a52dae5071c83bd5d8d22f81ad948bf.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	5a52dae5071c83bd5d8d22f81ad948bf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\Firefox.exe"	5a52dae5071c83bd5d8d22f81ad948bf.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1A4KVR3-QJ0R-1MWK-6TWP-GQ8MSG6RTR5E}	5a52dae5071c83bd5d8d22f81ad948bf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1A4KVR3-QJ0R-1MWK-6TWP-GQ8MSG6RTR5E}\StubPath = "C:\\Windows\\system32\\install\\Firefox.exe Restart"	5a52dae5071c83bd5d8d22f81ad948bf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1A4KVR3-QJ0R-1MWK-6TWP-GQ8MSG6RTR5E}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1A4KVR3-QJ0R-1MWK-6TWP-GQ8MSG6RTR5E}\StubPath = "C:\\Windows\\system32\\install\\Firefox.exe"	explorer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	5a52dae5071c83bd5d8d22f81ad948bf.exe

Executes dropped EXE 2 IoCs

pid	Process
2460	Firefox.exe
2376	Firefox.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4688-0-0x0000000000400000-0x0000000000419100-memory.dmp	upx
behavioral2/memory/4840-5-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/4840-3-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/4840-9-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/4840-8-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/4688-7-0x0000000000400000-0x0000000000419100-memory.dmp	upx
behavioral2/memory/4840-13-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/4840-73-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/2516-78-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/files/0x00020000000228cb-80.dat	upx
behavioral2/memory/3556-88-0x0000000000400000-0x0000000000419100-memory.dmp	upx
behavioral2/memory/4840-96-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/4840-153-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/3556-152-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/2460-397-0x0000000000400000-0x0000000000419100-memory.dmp	upx
behavioral2/memory/2516-412-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/3556-414-0x0000000000400000-0x0000000000419100-memory.dmp	upx
behavioral2/memory/2376-417-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/2516-516-0x0000000031C30000-0x0000000031C3D000-memory.dmp	upx
behavioral2/memory/2460-522-0x0000000000400000-0x0000000000419100-memory.dmp	upx
behavioral2/memory/2376-521-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/3556-548-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/2376-552-0x0000000031C50000-0x0000000031C5D000-memory.dmp	upx
behavioral2/memory/2376-567-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/2516-568-0x0000000031C30000-0x0000000031C3D000-memory.dmp	upx
behavioral2/memory/2376-586-0x0000000031C50000-0x0000000031C5D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\Firefox.exe"	5a52dae5071c83bd5d8d22f81ad948bf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\Firefox.exe"	5a52dae5071c83bd5d8d22f81ad948bf.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\install\Firefox.exe	5a52dae5071c83bd5d8d22f81ad948bf.exe
File opened for modification	C:\Windows\SysWOW64\install\Firefox.exe	5a52dae5071c83bd5d8d22f81ad948bf.exe
File opened for modification	C:\Windows\SysWOW64\install\Firefox.exe	5a52dae5071c83bd5d8d22f81ad948bf.exe
File opened for modification	C:\Windows\SysWOW64\install\	5a52dae5071c83bd5d8d22f81ad948bf.exe
File opened for modification	C:\Windows\SysWOW64\install\Firefox.exe	Firefox.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4688 set thread context of 4840	4688	5a52dae5071c83bd5d8d22f81ad948bf.exe	90
PID 2460 set thread context of 2376	2460	Firefox.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1976	2376	WerFault.exe	98

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	5a52dae5071c83bd5d8d22f81ad948bf.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4840	5a52dae5071c83bd5d8d22f81ad948bf.exe
4840	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3556	5a52dae5071c83bd5d8d22f81ad948bf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	5a52dae5071c83bd5d8d22f81ad948bf.exe
Token: SeDebugPrivilege	3556	5a52dae5071c83bd5d8d22f81ad948bf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4840	5a52dae5071c83bd5d8d22f81ad948bf.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4688	5a52dae5071c83bd5d8d22f81ad948bf.exe
2460	Firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4840	4688	5a52dae5071c83bd5d8d22f81ad948bf.exe	90
PID 4688 wrote to memory of 4840	4688	5a52dae5071c83bd5d8d22f81ad948bf.exe	90
PID 4688 wrote to memory of 4840	4688	5a52dae5071c83bd5d8d22f81ad948bf.exe	90
PID 4688 wrote to memory of 4840	4688	5a52dae5071c83bd5d8d22f81ad948bf.exe	90
PID 4688 wrote to memory of 4840	4688	5a52dae5071c83bd5d8d22f81ad948bf.exe	90
PID 4688 wrote to memory of 4840	4688	5a52dae5071c83bd5d8d22f81ad948bf.exe	90
PID 4688 wrote to memory of 4840	4688	5a52dae5071c83bd5d8d22f81ad948bf.exe	90
PID 4688 wrote to memory of 4840	4688	5a52dae5071c83bd5d8d22f81ad948bf.exe	90
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41
PID 4840 wrote to memory of 3460	4840	5a52dae5071c83bd5d8d22f81ad948bf.exe	41

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:768

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:64

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
PID:872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:816
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3864
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2880
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
  2⤵
  PID:3676
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:116
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:1156
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:1808
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:5036
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3396
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3584
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:4008
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3928
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3772
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:684
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:5052
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4880
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:452
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:1092
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:428
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:1852
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4320
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:4148
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:2228
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2912
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2232
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:1508
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:1200
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:2544
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:2032
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4520

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3600

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3460
- C:\Users\Admin\AppData\Local\Temp\5a52dae5071c83bd5d8d22f81ad948bf.exe
  "C:\Users\Admin\AppData\Local\Temp\5a52dae5071c83bd5d8d22f81ad948bf.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Users\Admin\AppData\Local\Temp\5a52dae5071c83bd5d8d22f81ad948bf.exe
    C:\Users\Admin\AppData\Local\Temp\5a52dae5071c83bd5d8d22f81ad948bf.exe
    3⤵
    - Adds policy Run key to start application
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Modifies Installed Components in the registry
      PID:2516
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:908
  - - C:\Users\Admin\AppData\Local\Temp\5a52dae5071c83bd5d8d22f81ad948bf.exe
      "C:\Users\Admin\AppData\Local\Temp\5a52dae5071c83bd5d8d22f81ad948bf.exe"
      4⤵
      Checks computer location settings
      Drops file in System32 directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:3556
    - - C:\Windows\SysWOW64\install\Firefox.exe
        
        "C:\Windows\system32\install\Firefox.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2460
      - C:\Windows\SysWOW64\install\Firefox.exe
        
        C:\Windows\SysWOW64\install\Firefox.exe
        6⤵
        Executes dropped EXE
        
        PID:2376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 568
        7⤵
        Program crash
        
        PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3040

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2728

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2632

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1924

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1060

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:764

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2376 -ip 2376
  2⤵
  PID:1592

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe d652da9cb153d6347a033a9368091db1 Xckvrb4BTEWb6IICx2OVjQ.0.1.0.0.0
1⤵
PID:3972
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2736

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XX--XX--XX.txt

Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Size 240KB
SHA256 a8100b1b27f51c3d88659a430c185a54354552a29a8a61bb7709df697a7c18f6
MD5 1f57cea7ad91a0faa8c07b279ea9b7bc
SHA1 a4d6e21f5ae77c10994fbe8823e052b4b5f20217
SHA512 80c58a57b59fd15abb365ac3f2b71d18cf9230d0c0dc7fcd7469058ecde9e1ecbba5a3ed30e90a9c3cd3a3ab8a6bab08e669aa9e36ed66b99ce245c0b5b98944
SSDEEP 3072:obMP5JuXLFG3Oa95BrKUqEQ94jhc3PQuPe2D2ue3NXR0jW/UCFnp7HBIJJyCwFiQ:J5JGmrpQsK3RD2u270jupCJsCxCT
MD5 SHA1 SHA512 SSDEEP

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 907b2839cb20b51df994dfe0f209ddd1adddc867a0d8a6a6fa49d4db7934cb29
MD5 7a8ec1ccb9e83dcbec441c603aeba69d
SHA1 cfa68af9cc4973ad9f2fa82b372bb1d210c24135
SHA512 bc1df82e6065be6046ad8d7693a86a0edfa91b41075287d12a8ae785325dc43bc2959d5cf1a7bbdb20ee3a846785b255b7ca8d811b401002d3a84d5ab798775f
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 26c12be85d1bc21c67038a49b9b61106a7bf10d3860ad5dd8f2f3745a4493475
MD5 b73a36ca9a0f80222508915d70168df5
SHA1 33954fcc0dec5ea356e3743016e8e1068a4cfbf8
SHA512 71fea29bf8ba3fc14cdc1f357d1e1f702eb4464015455916ca4c8b64732dd1ce4c069ee551ed27b99fb558b3d5539cda06edd3c05608cf72e979d79f6eedd750
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 54621c923c59924fbf6169ce95090af244ea2b5cf39a68617272a1ddab8affb2
MD5 a73afb2e9b3bf8003f32697ffd775228
SHA1 5c90a9cc56e54655e577549631b18d518135d3a3
SHA512 7839b3530494417c821f43cca4e26ef1a4a0f3ee76f904adfe326542239a873b93a8432a97820e39da5b4ee1eb2a7c33c1f34dbb816bd70ac02874a9203e071f
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 a4a2dc6c604458848a20a10a138ae8124936bc83fd2306010769b0c34a572420
MD5 b75ff154c3233c859364b68e75c943a5
SHA1 ef732103952bc7a95e3163cb55c4a949a5445279
SHA512 3f90f2c9f3d8c7dc3eec4c149f2654af4c48bbe301360d3700467c4719233b39e1af42eda062a81a4cfd06d72a02d6cf288a4484ca10a1d03ca6c4a3a1b78d23
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 eea69f7d4140c432f465f094eb7a050efc5b8460d095830425a87e4409397c89
MD5 0519af24bbd06198c4b96fd782e33c89
SHA1 5737b3cc3f1b21e657ecd7866630216437376356
SHA512 c738535ffc32ebebd0426cefc2b69f296f308d3ef964088055f3b757806e482bac1a086ff3197fb07b971083b1cc99209f200dc7d8369d7ac92808a06b1c58a8
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 aba5696138a23e718cc7177ed0f7e36f9e9b76af157299b1d89ce14a9a306312
MD5 15bd5416aa153d539881f1440c851c73
SHA1 150223e3651428b08232fdae6e1b46ac4dccc707
SHA512 387ae6d52825d2d63750045784b50d34f70e1269ebbedbde62298ad39430a2c56164ba4e9657d49f3ebaada158b66425073e3f4ee76bed17ac0f9965e46ce261
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 c48838badb2ee6fee41c5c6a8277f488476746a2c63f22ccbeeafb3c179a90ac
MD5 0c77365e804e1a673a1e3100d065fc49
SHA1 af15d4f2e2c36446d86f0bc3e7d9d404bb1a9922
SHA512 c2bb68923e8fb62d8790603c8e7a8a89c152586ce7a9855148e574c83bb645e64d7b820ee2876658c88ed128d3dbc81af01613ed647ce574321ab043f9326cd0
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 d6db749ae3a75fd103bf434d4e0c58678c4433d0e998f7aa529a97ba342d917b
MD5 d8815a5c0786b827d7da3bdc2c3e3b8b
SHA1 b67b98c84363d1a72ae19d6e2412ca02210477e8
SHA512 269a5ac1c008f7ea1adde009a2eb8f693ecd8f5d3cbeeaf58539f5c811755d7fa715bc4594060109eec9fe9b2109fe007fa8d95a1254698452b87c195bdbad3f
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 0127d44885f6f045a8d6a9b198c7154e42428460b2b589e95f68164cc835b3c8
MD5 eee1995237e394f4d74840a2c11ad32e
SHA1 88211d3f1c6892eb0f45db3f0b6cc17ce2ae4ff8
SHA512 af4c2cd1bbee3b571c61cea704f7bb9a7cd85831bb5da0dbc0dc2ee9adda0b0c442c5a429fea03277cc1cdef0481e8dfbcb79cea9d313aac9469b121fe48a352
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 679d6872788849450764b0b33d2580ed3408e3dc4785d4b722aad0bce3727a1b
MD5 04f1ef97a4d8c9bbcf98d01929866290
SHA1 a7826fdc9f40162d8ecd7103b5d6291994ff81fd
SHA512 1dd8dbff4377bca0517364033a461f03024e2361972b351ad7e4ee733175509b857506b16bd8f3b6953c8c2fca8848b5be492e9fd2b81db655549c08fdac17de
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 3a26d2542ab7d62ea3d168b8083eda0ea1f6d581153c405ef239d5df865e558b
MD5 a986c3d4abcfde4740917174c78ada3e
SHA1 4c1efd6cb4713a25ec30a076a63a8b12f28c86d7
SHA512 7a9113314cef4b2f91f290b632e88ee3651176447082533de848d948ee81c7fcff6e9261c6bed86d05128a8819eb9c4cd7aa58d1e1b62d2f2fc5d6afac811add
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 5115e65024ff0f225531f06d38b37866a22af6fc4f7d4087636410f959988de2
MD5 33bba949ec735f028582093c7d886e3a
SHA1 aa805c8b1b59a528e5cda08006b3407cfaf22601
SHA512 659b86f5115ea829ba4b3e92b2cd3afdcffe98f50bdfba13c084baa9c733c09b94a778309720bb7931c38b29f0ba677aa48c935cec5c7435e78d62350679bfb1
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 2bddeae435975961878022a388afb179c6b0daf546ae18cb1c4d8658a4375fbe
MD5 28ee5a3951b80351a527c20b24e8b425
SHA1 d3adf6fba983e82aedee132008815f772379ce6d
SHA512 50784d2c2d2b301b88afb826ac458de67af9ef2c159a26f75edb6e92e0b45306978dbed7a0fe5731067abad73bd3c516de5d1985a22aa914da2833de491502db
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 6a5c21f601dfd108d82c28d17a45ffd3b8b76e8c3d4a1a07f8ebeb6c79939a0e
MD5 8a985ba99d90b59b4e33495623c65551
SHA1 9d1064fa6b08406f235164060ea585692ecf73ca
SHA512 a3543fe9101e38b5ee33acd2b63ab53fabb11ba6ccf32044858f7a7e0aecae5c7991186989e4e8f629f5cf3618564960a3e2b1c06e3a9ef43c64152bc70c831b
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 b7fd59daa0f636e9da62837f2350f42df8c9799ef9835ec0a8b0abe5bef8e588
MD5 2db5a5766c9c2af055aba1089618c413
SHA1 7a7ba1e23f0785628eff6c3f5bd4b115728bf9bb
SHA512 40ee9020c7939e07287843743d586a8bf3895617fbc87cb113b85100f90a26c83d23d3fb55c7f9e7daa46291d08d31e816d921a9e5d7f454abbd624270dea706
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 05c8b0a02473f56b122b6e1549754b99c46cb097c92489ed13c29f90ee9ba518
MD5 ee38f4a82bc2c4c0226610d2f252efa1
SHA1 8f2572875ce4b18aa82eaaa4b5bca6c37a4baf3e
SHA512 226c862def1de06df6d4b1d49e7755c3baf36eba55522d738880c964f50bac2765632b7efa6a65d12dfe9668f6bfbbf0c4b065756d4e74387d0b72673c7843a1
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 601d0881ae3dc3b9c2b827c9cad2e207d80f3dc5a2a7249a78c10166c32d93f3
MD5 63108ed1a38be5e15395937aa6fa1ed0
SHA1 b92560b406e6f2964023aa3c7cad8fe72a4cf0e2
SHA512 3a382bfd2d889800b1cb14d9fcd43efea8385c1c63ed106dcb80e68a45cb36bfb8afd7dc13e4aa12ebc27b1f79583c17971954f97bc7be2ecfcd7edb5017ff1d
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 4feff1079f863dd90d8cd144830afa120df6f426825ca295f57e1ee1e7cf1eaa
MD5 a25bf419bef238ba2ef9b6365659571e
SHA1 14d94e1322325e686789c01bf9bc7b770be600c7
SHA512 5dcbc7c6fa92702d301aedf3ffab14c1863981e8ee00501038a850d335592b461a5810d1f15104c3b2344d070f80a92d9bd635b8e60b1c231d51ec011acd6cfc
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 5bb68015cde60fac85826c7561233d5654af37ac5240ceee1a882b817177e96a
MD5 0364b8dac2c0ccf9cde54b3ddd4d5c0b
SHA1 f6203833e8f04ff4f6c08e8a27b8dcc6e67fc1e5
SHA512 9ea0c7228aac96b7ca82bbd67e1255a45d528eafa903c861c2a2dac8e82668aea053dd303b557663b4506622e7653ed640b19a7e71aa0e05f34a671382f356e2
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 b81ab8cb6cf003bb3aad304fc0d2dee76efdc454677101993e2ba6f07c5da85b
MD5 34662d5aeb09a811e4db106a519f9c58
SHA1 30c2be04f1516dea46eb4a4e7e19eaad899afff4
SHA512 3a45d6779f5e4af26f1cfd5fddc202d083ec8a07d76180e31687dd26572a9f06db3de5bc47375d33820b86cdac95f9682af76040d5c31bcca0f8efdc57e43a95
MD5 SHA1 SHA512

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\logs.dat
Size 15B
SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
MD5 e21bd9604efe8ee9b59dc7605b927a2a
SHA1 3240ecc5ee459214344a1baac5c2a74046491104
SHA512 42052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493
MD5 SHA1 SHA512

Submit Download

Firefox.exe

Path C:\Windows\SysWOW64\install\Firefox.exe
Size 581KB
SHA256 3f7091c010cc92323b138ee8f1eeae07b94a4b60231a3ab555592da2513e4fc9
MD5 5a52dae5071c83bd5d8d22f81ad948bf
SHA1 005013dee49df222593e7ba7702a5eccd70eb4a4
SHA512 71ff7997397fd478884b426f0643fdcf0435fa22e047109890e0cf14486898a1ae5f8ba05d61ceb9c6f92584af4d35950491fade8fed2dab6c4483762ad5e148
SSDEEP 12288:50pfgdZwRu/RMF59vOZY8qPXBfAQ0tuzvK+ffWjo7U:CodZwMSPwrgXZmtuzvK+AD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2376-529-0x00000000025A0000-0x00000000025A1000-memory.dmp

Download

memory/2376-527-0x0000000000930000-0x0000000000931000-memory.dmp

Download

memory/2376-521-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2376-552-0x0000000031C50000-0x0000000031C5D000-memory.dmp

Download

memory/2376-567-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2376-417-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2376-586-0x0000000031C50000-0x0000000031C5D000-memory.dmp

Download

memory/2460-522-0x0000000000400000-0x0000000000419100-memory.dmp

Download

memory/2460-397-0x0000000000400000-0x0000000000419100-memory.dmp

Download

memory/2516-17-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Download

memory/2516-516-0x0000000031C30000-0x0000000031C3D000-memory.dmp

Download

memory/2516-568-0x0000000031C30000-0x0000000031C3D000-memory.dmp

Download

memory/2516-18-0x00000000012A0000-0x00000000012A1000-memory.dmp

Download

memory/2516-412-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/2516-78-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/3556-88-0x0000000000400000-0x0000000000419100-memory.dmp

Download

memory/3556-548-0x0000000024160000-0x00000000241C2000-memory.dmp

Download

memory/3556-414-0x0000000000400000-0x0000000000419100-memory.dmp

Download

memory/3556-152-0x0000000024160000-0x00000000241C2000-memory.dmp

Download

memory/4688-0-0x0000000000400000-0x0000000000419100-memory.dmp

Download

memory/4688-7-0x0000000000400000-0x0000000000419100-memory.dmp

Download

memory/4840-73-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/4840-96-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/4840-153-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/4840-13-0x0000000024010000-0x0000000024072000-memory.dmp

Download

memory/4840-8-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/4840-9-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/4840-3-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/4840-5-0x0000000000400000-0x0000000000459000-memory.dmp

Download