Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/01/2024, 15:42

General

  • Target
    62fa80b136e7caa2b4efe5b3a945a3c9.exe
  • Size 1006KB
  • Sample240117-s5txaaaeh8
  • SHA256 df641ffcbfcbf35c9541cb0b6b6a906ab5d19d0ae4f1299373f5c15d6c84b25f
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • cazador2000.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    driver video.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3472
      • C:\Users\Admin\AppData\Local\Temp\62fa80b136e7caa2b4efe5b3a945a3c9.exe
        "C:\Users\Admin\AppData\Local\Temp\62fa80b136e7caa2b4efe5b3a945a3c9.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2928
        • C:\Users\Admin\AppData\Local\Temp\62fa80b136e7caa2b4efe5b3a945a3c9.exe
          C:\Users\Admin\AppData\Local\Temp\62fa80b136e7caa2b4efe5b3a945a3c9.exe
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4336
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            PID:816
          • C:\Users\Admin\AppData\Local\Temp\62fa80b136e7caa2b4efe5b3a945a3c9.exe
            "C:\Users\Admin\AppData\Local\Temp\62fa80b136e7caa2b4efe5b3a945a3c9.exe"
            4⤵
            • Checks computer location settings
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:5972
            • C:\dir\install\install\driver video.exe
              "C:\dir\install\install\driver video.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:6292
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:5932
      • C:\dir\install\install\driver video.exe
        "C:\dir\install\install\driver video.exe"
        1⤵
        • Executes dropped EXE
        PID:6420
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 6420 -s 544
          2⤵
          • Program crash
          PID:6816
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6420 -ip 6420
        1⤵
          PID:6760

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 31fa9c8255c786ada8d06b48de0c9323d1363def649774e2837010bdf9a14c70
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 385KB
              • SHA256 e51eae724a5b2d71bfc4fd67d8ac47dc4b10fb4edd93880cded14ea97400b834
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66aa19cb63a87177bf355e884c1e2cddac91ddf805bcad121703381114a52954
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc890d00deccbd9c5671d4be5d0fc3d070748129c28c94ef4bffe179d98e8f9b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c831d418dce01ddcd0c484c3e71a32400bba72d2e0358893c7db10eeea13a458
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5a7504908252f6b7f1851301ee7768b04bb100a95f5fd62923bc161c2a8052e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34a97aca3a9d91088e657ae93680931ba9860f7cb34d7bb1e2c559499b341257
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 938d996f4c6b902c817ad88052384d62581a51f75958f20a63f5af64e5527710
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e78f642f8743d3d207833e6b60f779151ac2be8f4b4de1d42121bc268ebe621a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b21afd6d99731f70c794b667ef97b3567d923a09451cc2cf917a50a40210cf84
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89f7e9de175ca60c58a6cced21a470687aef935a423cdbc2c156a3faad429a17
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46023e2196ceaa1af209e4d3766e5d70216c67ec8444ce9abb48cf514400dadc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df35e334993199140c5cfdbe9d0379d21bbe537fa801563e4cf278e3c21b009b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c32517fd64ef05df03c458fa5cd542acefb5453c9306540e19788b062bbba690
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d05ff1923aa1f1cb8909d37132cad400f448a4f49bdd9e0abea4e43c16d2892
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5529fb4b326f05e473c57c67c522a6a951b2211ee0dbc23d25ccbcd493bbda1e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cfe1d7d38e4563a387146635062ac460ad41cafd1342fc1b7e718bba85eaa634
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b8271097457b60df7141366c3a53d05bc33f02e275ce7deb461d828e1c311a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86d0fddb33254353bb4b3b5882ccee6d21509e3256d947d8f0f419a9fd7a3c1e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e6c222a1bb773fb86732703b13982d64a52b0f17347ed74e832a911502ac2a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1b931023b8ade26e43d7fec75b596cfb2709a4efe29a7f020c46c14c4877b0c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1c494559eeb218a3653a6b332c90c2b4ffc333b068675a363db6482144af419
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c50d332ff5f9ae922d02e183557ba3a4230ee7d3bff3a2f2e28644568f080f21
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7f7203b2fe16cd5558d09adce15038886501b09ded04a75207bb1d4dd2a6390
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 82f9e5786dad97788fa4045c4273fc8b5745c265d2633870c5e997379c36dda9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da1a35ee96ac1a153198dfd0aba6445a098c2abc60ac13a0e4e9b7b0a532fb27
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8ede9bd7929f583db115b8d2b845b2e18fde4e2e6baf66e827a2ecd8c0929c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a04bd4c1cb7502acd1bd14fc9c76cb5b2c0f8eb9bb0703c32ccf595e2d2a785e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2eafa499ec42d47d9d29b948b27e088b21ad8f76eb7b980ab4074359886daf4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 32ac6f1ae4ba709258ff7bbaae1498120793583835dfa213c011f1e9ac713aef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c7030b083d7aebfaf31fdb02f88342fcf81803605dd945464d6bb43c3976bbd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6612e7ff512660209a4e769ca41d93d9b47a6f45b526b21f3fa810511f261370
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6ef1d883f143a3fe69d5701963558270e632a0c48cce9be8dd186dc00ee7cf3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 288a355257b0838a1c6075b935035514701f88a33d4e9cfe6a7d101ea409403a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d8e588b0683b7356f05e8da4e37f332b0c8fba9bc34532402902316c32b15cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b18cfe6868500051d7137218f62cdded33b354db6fce40ecae45881971022fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e5f0b81d702917a5f576ddbbe75cd90c0af0dd0302bedac5b306ab0b17bef30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3122403d13419efb70e7b3de2ec1f583fbb861ea5f625dcfe67d7061e89279c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46fd1ac9de1ff294cbddde200cbdd5691de6df9413854bb7a8dce604c210be63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86acfecab3038377b17308c53eba928b0a927669b8997f74a1f2e17827533740
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8c1419526822444d11f5568f69fe5b21a34450811157e5e3e8102422bf50f4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2574c9da2d655771d5f23d8de585c57960fda04083a4c6025d1beaf4f55a3aa5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1a61929be59b75d0549556c2612a0af7eafd072a085ef51c59af2eac806c4e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa90bfee35f1b876a9178751b5ab24ac235bb7a3b6f879b0c5a428b7c9be05c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eefcddd4739b1bd21d1361f1be8f21d0fd47e974a910f3c2eac1957f9a50b67c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af30f93900f19f30b893a6b8102065d4052f35af01f78a7757966636aa9b0424
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ebc05d9ba0aa8536521c208d2fbc4709b3f1e645701aff0e7273b23859917acd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9bf2982e241e0679505e34e2d69dd4eb52ef32aa5f3fcac8c1f14d0c1b670ac4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0daae3fe6404f7d88aee2497d510adebd283103861429715b2d6447d1e864bf5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e8d8759f220d9c74dda76ced388a1468700e2751ec2a82fe5047f7af206fb1b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c00d46ef61562cff82d8f41f7d49364b538395268f5cb98027ba1edf4fe9667
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d3f11a55b23d993b34b72fd26410b40ffa4c6913e110f7703147c22023500ce5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0583cbe166589bef5921241b1600016e9eb27f812099db8d63768ffff8598d99
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ae488aeccc596008f90ab9b7e8146f0512b9bc319bf6760eed2be085b2e8f4ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84ca1b7b9f497e50af15483868c42bb93a7d93bcd1397625f4cab47da9b86254
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11178bfedfb891d925615894ae6b34bba991e1ec6bcbaf568d73bcc642d6f658
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bfbb9ff08ae5081b8a30751fa2d7cfe43af6c3a9ad835bc65ae3bb0de32641f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ddc985b1d482c73444e7a9cd5137b3739b7528f21ecfe37677c1282e1be34d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e4f6c98fec65c6f1b7a16534a3f363bd70b4f6fffb19908c8b7e1c9edfc78217
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f6e80ca748133e3775cc86b8ecd0f158f1b9886e6c262a541d606d8023f7999
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8dc04bdb813d0b72f5864b81363be95c4085857c93dfe3af1ae52c5bd5102bf1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5a0396c80dde1a461f9c534607f2e39894cf7296f08c9ebb583aa5b40daeaf1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc3808412c7f09b0cccc27bdbd4b84c54752f0270c2eece69b6a5de53e5db495
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bc24e8ad5240dba39a0258486e653d034428677b841fdf9a310caeea1ea10f04
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1df04190a1e3d726e92d2d0caeb6f22ff24001e9de539d0dca586025858b922d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b491b491496c658fb92b38ed31717028c36acdffd6a7e8ef903046e754c1ec52
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6412dc65398a6e776ef09f1b3a0a86fe3c74475dfbba6183370131fbd12790a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3bed17b897b44a5472b9895b9b1c2477ee565e0d6005d90503573b7c47f8456
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c94b62df0959e7c6490db10cee5ff3b149f5b14a8457fc8c92649e87e8ec12da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 edc9b2105d8a601e4efd5ee9d59fd658a616d7dc7cc4b80568eaa3ffdc1148ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 717ef890a36d848c4dbb16976b8981fc00356e452069b9e2966eb47aedb66c7d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c575b9bfc64896d07d257d82542988fad5b277a310459b19247bbd7c6c1a447a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9b0c672dbb7a3dd22bb0370e0315c149a7d4ea877378b3f4dbb96066eedfa87
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7204c6deb44ebfbaa4e215841034994dc7f3db17110975a3d602f4da864e98ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 75f7c5261670a97c14e665b352215fda704391da7c964d698964ffb688fb255f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 183e1931f2cf89898162297981013a4c3c2676450ff98c669c4d16b513dce45d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f826d156bfa5972401f12d5b4f54345bd5f454cebfea98c2c4c92cad6a93dd52
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb189045c2720d5a63ff9e995c6b6c3b743d3f73f8da1fb0ad4944c3479bf5b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85dcbe820e581951435f3c4fa97c0e2d03ab85aaac9092a9378d86edb7ebe124
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d8c7cdcd31f6adac7ab9eca9290250634a248aec018c397750261e344474b85
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28d40c926bd0e49924da2299dc6b21c15a21166f60cc0db5f29d81bfa5a7b89b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 90ad2b7b6b3c12068a8d129c0bb95524392900807e86e9a3a0512417b4ab6585
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3751317338c7e5312bacdbdbac43ddc6ffa6f78a61feecd480b94f89fad4f66e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d98da18351114a619b3ba5acb1aca2fdd8901493796e6508f713d32bdb242172
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6623e4553e5e124b87bd8af5b701583e9564a181a1cdc57a4550bca7d6ba7abb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11f3dff3961468c79813184d4bb8a85ace2b429d2d667173758ef9d3601072fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2213bf796fe76507b7f24ef3346f2d9485eaa17cb9f4f65a201b74760b3fc0c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e67ebbb36c8718aa0e2668f93e9c3b1dc35cb74bdc9dad20e34b90b8099a6180
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec5351b696e1d5588e6d56381fae19e3e83dae207c0621caf4ed2a7fef13d9c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 53ebe09d637f71b4a84674af8959f0a6a93f38308d3346161ea513d9d2dffd6f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e797af651a10c57126b49263bd7829c546713e8d1fb58022797c512ac278515b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0bb704a04b8ebd76cf19a19e7b3e23723ecf86925276f5573a6cde63af3bd42c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 10f2818e2291da6267830627cb714871409b73efa7afe247f7c28a07fdab0b6d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b47082ba2e17cc352c25146c975f2527ad0d6ea878fd33004fc6928de3b0930
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8785e6e45cf971a5fe23cbe42c2927aced8bba22d2aeda35d3dfba0bb7b2495
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4fbfb69bc9bbc6055bee1b9589d18569dca74b2561058a29bc80182916bc9469
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f511a06bfdf57c4a2276cc24a79e51d1731fe47ebb2718aa6a26adf81b14f91f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2c403daacdbaab6d2a54e7d1015b99ad0bc48b591f5d63ce1fcfb62d527237e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9300fab01368a9312199ffb5c3ac22447fc7f0688b83e8fec5549928036d49e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1206583096c1198776ba5c4b016c91a254a3dbba1746cd76979c94223b415301
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad483575a9b857c4970a1e32c1f63b846ae45c6805fbd4d1ebd0bfd1288aa83b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf0814fd975b2488b7bebd4d012540108cc5a3973cba1adee0a98eba345c54fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1d8548c7ee209fb6feb4299281c1eb5054902be757ecc657e8109e281496846
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7411b4b57aa238be419f44b78e6563ea52f0d21423b291758606560e0b4c9d58
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e1c2c881c17a06b01a9661e8d823edce7c727c626d5ef30741bf645df24365b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee61a35cc395239e6438c2c87feb74b5a1d5a3a5e91211c48924a446da846bd7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9baece477a27e9c4992518d779f74db9e32c0b1c01f37612d1a72d41b5b4742d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7804ac7b262f3b621c5a039543f2b2abef85dade29501d637f56e95ccab8046b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98cd0860c969e2b986cac43ac712968444dc8f735a210425fcfe285546c3d935
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ac0e697cb3c9ea80fbc97ea43ba5a0fffb12735f346e4381190f29633d728ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1087ef5eae5d809abfe855032daa3b0d3d8357a7932111b3e4af26f1927171fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c41694371f362adb90f2cb05c7a6dcbb5f4ea193e7e03b28ba737339022684e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6be7fad64fa73a25ac55304ea6998a15ff129a2451e80cca049f89cb03d95dd6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2238dc556d1ec894e362e8267aecdf1788377e024b44bbca9a1d6a396a541fd5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c8a75df64230fcd46cf749c08195bb8a807eb7b104389b2eaa0fd81c492ef16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 47932586a26dda5bcdcc07451f3c7417970c2c0d887f8e59563d1b132a4a0a44
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c6aa66ba4c3235520f9b9dee0e2968916ad34ebc99adbea20e3c541bd093c4c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa2b33b24ef46fc0ae0f60d14a35539cf455fe2d4bb5475c49bfdc2d420c3511
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed43659d3ed93eb149b0ccee7b0f70861607c1aef15782259cc19d41fb22fe3e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a655dfc269be42b8bf0ef9d7b670e85300d1d454d61f16de7597017275eaa180
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 96ac1682f2e2456826c56c7d8a6488fbf7a800a20913ccf9fd26af3debac56d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66eb1182dcaa546816178e01c06037a9324cf7d9cedc0804b915af95f1366bb7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b2706ff8cb05fc1d64cab97ac26842d510d4cb5f6373404c1f4b77bda385924
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4db80cd5fbd65c64e363bfbbe893038b2976ebbbc2ae9e1e7b881446d2860a24
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f124dfdb4017efa23bda3115f4596fa5efd2c36ee36d89cff13244b9e151315d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce61718849ad870ea4877d6d15398412b991ca5a4cbf8b16c4f810e088dce82c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 128c26fbd13cfdfd0fa67a5205e2b7106ddb676bfbb6f8555496011e2cfd3887
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1094b5aa2d3493260d867ab9ccd302eec4acd70500a517ce66dccce79f87608b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f07a2177dfec844da6d4c91b00e2c05359f9b60b307ac88d3233880d701a8de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 35bad19eba7c0b2f5d13ee7b90604d551d881e9278f3b24ffa331e3c38de12e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4042ac24e17e5e6103100163bcc04cd67ef33b0ce8c1ae52a09f062786e077c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec4d24dcfd72ce92d88105b30e3e20d584fb75fb6f78610e7ab21c57868f6e9c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 10bb7d5558a07036934d7ae1d9f8e411001d6f10b862ac1b08c724d9b7c43de1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0315a86d60a02fffd0c8a1a461cbdffceb8406ce4480e0ff9778d5233ae3f91a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84710532a6de364bc48e83fdf5fadb218a7a67a669589acf05e6f36e17f87869
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 afc17b795f4f74016f4ee619bb851253347d59a6329950b6d5d7046789f8e335
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ff8f1975726cc8bfe095f6d895920e523b1a2b850164d583d78305ef00399d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3713dad715cdcdeb1bdc854f82e344093f67e379e53af5e3ead04908385ea868
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84de660645e6857dc13662200fe3550e1d29cd7883d5b0a43d05134fe9872e71
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              driver video.exe

              • Path C:\dir\install\install\driver video.exe
              • Size 1006KB
              • SHA256 df641ffcbfcbf35c9541cb0b6b6a906ab5d19d0ae4f1299373f5c15d6c84b25f
              • MD5 SHA1 SHA512 SSDEEP

              driver video.exe

              • Path \??\c:\dir\install\install\driver video.exe
              • Size 382KB
              • SHA256 c935a21339f5972f5a5ad76859ee49c5ba76efea4568e7fefecc266dc15910f5
              • MD5 SHA1 SHA512 SSDEEP

              memory/816-21-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

              memory/816-689-0x0000000010470000-0x00000000104CC000-memory.dmp

              memory/816-1413-0x0000000010470000-0x00000000104CC000-memory.dmp

              memory/816-22-0x0000000000B70000-0x0000000000B71000-memory.dmp

              memory/2928-5-0x0000000000400000-0x000000000042F000-memory.dmp

              memory/2928-0-0x0000000000400000-0x000000000042F000-memory.dmp

              memory/4336-3-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/4336-1372-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/4336-6-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/4336-8-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/4336-10-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/4336-14-0x0000000010410000-0x000000001046C000-memory.dmp

              memory/5972-2072-0x0000000010530000-0x000000001058C000-memory.dmp

              memory/5972-713-0x0000000000400000-0x000000000042F000-memory.dmp

              memory/5972-1371-0x0000000010530000-0x000000001058C000-memory.dmp

              memory/6292-1402-0x0000000000400000-0x000000000042F000-memory.dmp

              memory/6292-1395-0x0000000000400000-0x000000000042F000-memory.dmp

              memory/6420-1404-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/6420-1409-0x0000000000400000-0x00000000004AE000-memory.dmp