Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/01/2024, 08:47

General

  • Target
    6cddc10cd6d98bab4b423e131aa2a898.exe
  • Size 380KB
  • Sample240121-kp2cesach7
  • SHA256 af5e6d5c1e2d46d5235dc555fff10fe8049d65259ad5cac992e2287ea4d2d840
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • mazika.servemp3.com:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    settings.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3524
      • C:\Users\Admin\AppData\Local\Temp\6cddc10cd6d98bab4b423e131aa2a898.exe
        "C:\Users\Admin\AppData\Local\Temp\6cddc10cd6d98bab4b423e131aa2a898.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5068
        • C:\Users\Admin\AppData\Local\Temp\6cddc10cd6d98bab4b423e131aa2a898.exe
          "C:\Users\Admin\AppData\Local\Temp\6cddc10cd6d98bab4b423e131aa2a898.exe"
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1332
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            PID:4716
          • C:\Users\Admin\AppData\Local\Temp\6cddc10cd6d98bab4b423e131aa2a898.exe
            "C:\Users\Admin\AppData\Local\Temp\6cddc10cd6d98bab4b423e131aa2a898.exe"
            4⤵
            • Checks computer location settings
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:3580
            • C:\Documents and Settings\All Users\Start Menu\Programs\Startup\settings.exe
              "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\settings.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:1896
              • C:\Documents and Settings\All Users\Start Menu\Programs\Startup\settings.exe
                "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\settings.exe"
                6⤵
                • Executes dropped EXE
                PID:3852
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 524
                  7⤵
                  • Program crash
                  PID:224
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3852 -ip 3852
      1⤵
        PID:628

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            settings.exe

            • Path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\settings.exe
            • Size 380KB
            • SHA256 af5e6d5c1e2d46d5235dc555fff10fe8049d65259ad5cac992e2287ea4d2d840
            • MD5 SHA1 SHA512 SSDEEP

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 53e7134eb37210c2f2970a4a71ae57f1a5e2deafb4703e0157b55d63ad1ee714
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 e015d8033d42b89de49f41b54e68bedc6269a9c3551031d59d50053e993e3bf3
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed88ac74bcdfdb2efa6ef1d5db7f7b6632ffeba6706eeaa850eafd8e8ca4d51a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b860731c69980a05419d023cefc9add361e1417d8ce78044b8438763c58e313d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bef97b2b3137aaf88353b0c099b7dd1324a1d6b70e7b034ee9f45671b1481eba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72272a30a1641e4f3582f5d2aee7ee93666debd10f100787ef4d14b6cc34bfc6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1eee705f6ebf02c21f490f12ada20e7bbc69846bd951bf72665a29324b542fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e3912f0cd50062eea7d9b994104e84eb079db227ef2a9b2999864f4ba174eab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4bfbee143296e9b8bcf2aa2968f42d65bef0a063ce446c22c27b847b78f450ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99dcba6d087352b5f5542f2d6846568730e4cc9d0b3e3ec00fb20d191adceba7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b57ff85f80b9b47e5e0de1922fb8795ac31028a4ba2fb5e5828e1f700dca0787
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68355d1e3f33e55721a4c7ce44d5c0dd662c9422e35fa77263f75d77833e825c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 babd6c53cdadc7d014b7e20ce64d580b9c800f67b3a8fba66ed5021a7d1d6f16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5caa8ddf9a6b13fc8e1819aacf1ab8241ba01842e64e94e2316051117297b4be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cea13c8dd7ee8cf0739f8cf3f2fdd9e6e5991656dc6c4c46687731b66a57002
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48aaa5290d59e0355b1195a55b8b68e263f84f2a6cc86172e47ebd016c2f1969
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a53db13407cd18ca6ffbd084a960cf5adffe004a2705f502ac86e161baf9c0c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 736be151310176c6d68551e998b1af77af1d0213087bf5fb4a4e0ed383845e81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bbb7be4b2e093a4c88bf902d823b86645ae8fa0c27b5d8accc4648d7ad1a093
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2f8cf3a3c244921e8fedea51d256a402272c78e5e9a13e4e5bad237aed92118
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18e2e7a574922d222297b2ea5fb093ef8854f13f94b439487f249d3d0877eeba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0725f7d074a1a7a2212f208b82bd0cc45d73bdae08cf2dff59a71028326f888c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 702b4b9ba1fbef7a734d314205b0f9a7a12a8c671af7dbfa3bd0a2543f79d626
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3af1dcbc5c6f7460cce8002bc6095c2a8c7f501f24cb6a0fdbcb24ce8d90f8cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5366616e750f4095bcbb8feaa7ad8b5ee576a392b3a6a40b80a5fec12b4fa645
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6d4ae641c79eac8e46bd02bd2c1a5b45c5c9adbd7e526eb5ab8061847be8e18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6dcd844a5008d52f1ad7462bf4ff5180b83db054bc2bf91c8d54a8cc786de2d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5ed855de7e318db52d3c14aa8692a86575f849ac62d06aa4143e459cbd57838
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7deb433669312c1d06cc51d5b20f561226ab7e16d63391136beed77c74d273d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 869685dcc0b884cbcfebd412812b2d1255eb56f4bf147f89888ab3efa54c3bbf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d411c73edddf9ce504af75ad8f6a28d365fe18b0f30be4490d906171d035b25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 343b619f832f954790476bf0af39935d0218319f2839d92f850d57bad1de66b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7505e648850b43ea819676b70f4763ab92091bc7431f99554806243153ab430
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b490a971bdb381bb3b088aa87ae632011f297b87dbc724cbc305f80d184a9403
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da1984818514f09ee9f7214c96972e0ef7e6fac3fa377c9476bb6e55cae52ede
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b1267d9f6c434a67b50f12f2ed2f065d763a8afaabb33cc6473591c29100f7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c901fbbfab7623dc72585d0ce1ee3e0a18324fdc6e1432fe41bc5effc6135a6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f5f197f2fa948f8322eebfd4582bf871721f2709dd90a77b1284a498ca5d366
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a6810853d070ce2a3e4dcc2e9f8c81b0e48a48af0ce59503908dd3e8b361be4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a932dbbcedfaed7a552cfcc59e9f889065ae17c89c28fa62301a8477a06976c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a462bf435ae47c8a4621aa621252db66e65570ec56279db706898bf729fb2c91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8089745de89473c8e323baf75d70e15f24101bcc8ec689574d41373f4339477
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13b4ed317af7a7898b3c9e5f68032b289fc9ee255628ee47620635524df797c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b6a26200a711067938c6ac3704499cf97c51cb66aecc35b7ee038906894d253
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81068c3b173357d88181ab5d922b826cfecf0a879d8cee7d83f974d083dc2551
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac5c994d1441d0628fe3b3f9da7ec5c79a2542c5b8d14afc51255b55cb216e45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12fa13375766afd495129529a9ab4bf5e74ac6c07f7cf3d61502c868e03be6ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 313c3c6f941437770c78e5ab3b63d2e37710f3d1788cd25daa7bc463b61d9cd6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8621b17e2fd8309aa4b7fc2e7e04f49616c170a61fcdc5de167cd858ee215d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71b829178ebb6909e1d26a7f0888e21e70540f48887e1bf86a8a53b5d612198a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0bb11f2d1482702180a3aebd6b5cee587a2b07525e1e5e8a4bdfc86cbe2c3c6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a524f09af24f465540242a2d63ae5021e5b75ca608f86fea5e9e49d3837e76cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8675f87105fd5149bf2c21913179ed6a46d6f13034db1dc28981cf2bbc0cb3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc45d5a7c07ddf1158474e4b8d93d74b432b3c12db168742e180299dca8bd3c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29dc0f5e860c374a9468ac7471dadfcb81beb893f06a39c9a287f6cede94b0a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f90ebd7fc5fc8178ebbce87f228193150146aeaa1a1531471011e6a90753357
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1881aa2f67d10eda672e6375d35742c52accaf107cfa3e1aeb0e435cac08f3ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fb9e237f867239490782039d0da2385a0143039bd21776d8f08b8eae0b1dc1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc6c3bbea31a6d095762727d8328f736bfc21dd50aa21508d00603cc357fca8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f181c8240bc0ae657a3d325e9b22b8df5ad8c37e04e7714685344f6e09ea6b89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 580dbe5f5db50c45f158a1de5b559ed3544adc0ff1f2758de4f0ac67c379c981
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e12241879b4f5e6743b4ae176d3c62a89945d469265071dd3f06822d7eec1a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7bb277a6187b33d7a102780a8196929b7f295e9948a480204aa92a4b78381e09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3db5a9317d3b187e44917eafa22c8cef4339c55b696344ec5b58c2bb91918f21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 622f348504d3322b0fd3e871295cd03ebbe30e781c3ac0752f92a6df616151bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a93e2191c9d81f15202798bb7cadc917e1dcaacf42c6f6a42167af49ea4d177b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 570cdcb76101c00431c29de883b8ea2b4a74e8d7db358449ba9e30b406188660
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3d54098591830d2766b91ec94dbb8c036fee569c87ca0f3e624554f0ddeb8a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 486b7d24ad0056f2fcdd1900d6ee6696e479843aad6a966190d9daaa624d6b6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 107c2dbca24a73a081f17ad9429142b1cc3c24e086f627b301a0715a62087d6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b572f0ec288b0683e3e8c63771ad96be5f4d6ddb4c313dc167c4034281b2688
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f9bd0c89ba69a63e3436ca54a9f55184332062e949df4fe6cd346dac5476f18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b65798c5f94c4f0dcc9c7560017593887c2fb7ac9582ce3d9c11949f8965f954
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 becf96604213deab3343e458ba86b10769b62b342e27064d838917d690ae4c5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24de6b3354b1ffdcf0c4259b14e6d24f86aef0015e4f83198de591c7fb1bbc46
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ced2c37d54bd094e73cd46ac89189457c722ed29b0e732e9e22c497d75f59e5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84e681e95c12b30b41e27f0580eb558e85e26a4403ac871d278db36370b1318f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 910bad5493ab129063e9678abd53c921acb335d226e6a169a87589f8069ae410
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56290c81d81c6d2ed96b2e3e5ef4aa06b32bb653e5c17f1972dbe840fbb883ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16e121d1cb502abfdd12a69270f009eabb6f61bb27bf032dc2034ab787fdc79f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 735a41276bb8de3cc870f41a98a45a2f5c635748e429ba08740d592016536802
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54c88fdeb4751feb9ef645b6020eb9f7025ac71b510e66a42422212cbc7032cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4a8d04b4637f3a9ae237837ea2cfe12d256ebae1fa03ad10cb9494ebbef8297
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 532bd83d493e2de2f174c5426a22b49431d83189ec890b5164a06cf59f14c69b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d81bb398b8652a0e9ef21789f1436fb4fc5b172e8650a0f56dee9a51ab44cff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a9a67f8fee4e2c5aef4f8674ac32cf9cd3499af33c9aedca723668960c0536a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa888124b47753cec45ec2704f0ce0a5785d21f9a7f8db7c0f330f9f612e252e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26817017a6b407a88074d34c3642207e6dfae677e7158f9ac0842daba2a6131b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d04eb9f4d73de92a985c10aaaf15ce926f5835e858a1654295cb3fb63e829da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09e52a78daa7d06e756257b3b3ba4d9a52d096ea33ae8a3bf61e31cec2519d6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af1a382b5a2bc1bd75bb4c2f89b8a03b1ffe61db87b6623edbd368c913e389fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc2197181119e30651be352146c79de688f7b78f640ba7fdfee7fb020fd1625c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa1e0164d0b535d5bdca854b6c2ec7791b2141f30e1ba1b0ae6bf269855df6f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11603c08ecd362f1520a877e25fb9d3f6e64bca4d16c589cf47aa750195df194
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7993fe2a17b3abf0aaf171a7b29271b4ce75366345c8df80600310b62e4655a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15aa1b7402d97f3b87712ef3b6ed6bf19cfca7abbaf9ee2feef707c08259e3c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9b160e8d220ad10cf4866e5c760af88f01559bc224a8a2e1c226e4bc0968bdf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e222bd2b2b18e833b70060fc41720f2ecd7ba7d7f60e018d1a4ffbf9e693b83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d14377ddb063aa68919e5c0688087dd917da5821a8d92bf26c97311e7722017
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e47c82e1a223678c2ba713186d947854a94ffd4a7acfc5b481c816f4edfbc977
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2654fbb9164c99789fc93baae0073198e8fb70e911e81a04ddce1df554365207
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 591d7eab53406f7346ccca2e231063c324893d2e3f843218c444a8cd716ef774
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2166830fe2a6760d34746e1d940e8ca69495b316d80797656fc0a9f775d0cdf5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed9d7f2a1478e276b9a89d2b15af6bf6be349ec304fbb8bd18f87c0071758395
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a2d2f5edc33c9008208e50f1220a5fccba0a48d8591de77b825cc66e918f358
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19f1bf1a09906f09deb63caaa32d505b9b7a2e948925e69f8690dd4a887757c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 948b682032a9cd879e91fc6447f2138b96e8475e55d4c57512b0ea5081720db7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83754bb739345e7ad54291942c59c6bd12360a7a2a67ee635bd1120effef56e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d06b43d94b5fd3d83449f4d918a6c3268ec8d0dba9982f674b8c38e31dc0f094
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0324c598ce10a6d4bfe5252c9a07d1f5fb2dcb966c81506ac62c4f39372132a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2c4550ad9687fd5140fbb2318fa5d0e448742c7a32c2b76c893c4eb65c404a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c49129e3a8eb3ef62e3fce550fffc87c6ca77970fb4e0ab2b33a43d10648d0db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf01f00062228a28f70384af043c180c460b0f7d504f4a8fca62605c63bc9b52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c9f315169b4935217898ed381d79d1cac71df515ae10d66b16bff2332e35f14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af7c8b7c92821d65e296808b45be43493281da519971fc014c56969020411d04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93b7c9da2f5f308df85f8318536a96c794da552c0381bfe467ae779817d4f629
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7582f2889a9a5e793082bda46ac94d240004bbd737d9c10d5ac0726f2d75635d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0bebdde193754070eb435014cd3ccb8bc02c021d5bd76282bb0683e7e947820
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c76ef86c5baee2fc620d1ea1529e27ea76c487e0f86519e5d99b34fe6ab81a5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79d589dc2fb0209be4b63df297e23e731732965c20d2c843a699d3809d95b74f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6526ea7270dd64d73c205c1238c5cb288a8e3e53ad0b0b905210cd37c2bae38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c90b619a8564e379633efc82bc889b31aaaf575cda4726b60581f1f94aeaba6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 815b0fc4c845a989acdccf8335220deafe513b189f98e27cc607745bc1b117c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05af281a42366da8a738193be71c789d889eb7d5f28f5ba4896f29a4f7f60e39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65387ef672344711b9bb9d2a9507e86af6ce6fc6d90f4e6ddd4423749dbe4089
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84ec6b14348f58f7f451f4a734d5c800156f82245651cad4a452691c562a484c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f7c3df830830624e379da3a383f125b340770efbc596df22a12854b218154b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee851ed2c7a5328260dbb02ebd2c745257ed685747f8f80d5157af327539ac8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0a2bfcf53f330fe009e258b6a212d89268dd072f97863ab143a0e3be138491e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa7347b2cee53e06ba04703fd020500d66569a395e8631638d27767edd2f0d56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0572ae21534f1f6aaf789cc1b60b8bb932518642751016b8523f8aa10e7862a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acd940046b2493e5543a19ec9d634e39c08264222fc357adf302954fdf7609a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c846b48d1395daa9899123e5fe8b57841c83e5cf7cf7443b3be875412ddb023
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53ce77e8f25dc553dfe43727d6a352ecdfa45566a705d506bcd7d824c9a37add
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1349c000616da269daac88aa0cd5c7c168c90327d32954f9e1200bd7f5cec43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aad1788b254cb758765361691818b173fb539ed7a043882a4466cf7a1ec59722
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b047c49d6fd1f07a375660b2f8fcbd9e83962630a36aa7821a7f975a082a826c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27cb61b79e094636de3dd542a6f4d32c7ca23baee173fe440c6dfe9b89495886
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42a8bf200fdfae5fb800279493bae4cbae9af9c523772039391fae1dae9a4ca7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a48569896331f6cb26f909d1d322c18e7fcc92d80bc61d2282518d582f083f9
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            memory/1332-12-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1332-151-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1332-111-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1332-3-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1332-5-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1332-7-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1332-8-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1896-182-0x0000000000400000-0x000000000055B000-memory.dmp

            memory/3580-88-0x0000000000400000-0x000000000055B000-memory.dmp

            memory/3580-891-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/3580-150-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/3852-181-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4716-17-0x00000000011E0000-0x00000000011E1000-memory.dmp

            memory/4716-16-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

            memory/4716-77-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4716-184-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5068-6-0x0000000000400000-0x000000000055B000-memory.dmp

            memory/5068-0-0x0000000000400000-0x000000000055B000-memory.dmp