Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2024, 22:07

General

  • Target
    75a14f95eff4e1c46dfd039ad50ac1a4.exe
  • Size 532KB
  • Sample240125-115f8agdb7
  • SHA256 e7556362b36241f3ed4a8715ea857732cb355dab0c8e46357bd1d8a37768ebcb
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • than.no-ip.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3628
      • C:\Users\Admin\AppData\Local\Temp\75a14f95eff4e1c46dfd039ad50ac1a4.exe
        "C:\Users\Admin\AppData\Local\Temp\75a14f95eff4e1c46dfd039ad50ac1a4.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4404
        • C:\Users\Admin\AppData\Local\Temp\75a14f95eff4e1c46dfd039ad50ac1a4.exe
          "C:\Users\Admin\AppData\Local\Temp\75a14f95eff4e1c46dfd039ad50ac1a4.exe"
          3⤵
          • Checks computer location settings
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2556
          • C:\Users\Admin\AppData\Local\Temp\camfrogpwd.exe
            "C:\Users\Admin\AppData\Local\Temp\camfrogpwd.exe"
            4⤵
            • Executes dropped EXE
            PID:3820
          • C:\Users\Admin\AppData\Local\Temp\3AMD6.exe
            "C:\Users\Admin\AppData\Local\Temp\3AMD6.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2128
            • C:\Users\Admin\AppData\Local\Temp\3AMD6.exe
              "C:\Users\Admin\AppData\Local\Temp\3AMD6.exe"
              5⤵
              • Executes dropped EXE
              • Writes to the Master Boot Record (MBR)
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1584
              • C:\Users\Admin\AppData\Local\Temp\3AMD6.exe
                "C:\Users\Admin\AppData\Local\Temp\3AMD6.exe"
                6⤵
                • Adds policy Run key to start application
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in System32 directory
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:4640
                • C:\Windows\SysWOW64\explorer.exe
                  explorer.exe
                  7⤵
                  • Modifies Installed Components in the registry
                  PID:2612
                • C:\Program Files\Internet Explorer\iexplore.exe
                  "C:\Program Files\Internet Explorer\iexplore.exe"
                  7⤵
                    PID:4084
                  • C:\Users\Admin\AppData\Local\Temp\3AMD6.exe
                    "C:\Users\Admin\AppData\Local\Temp\3AMD6.exe"
                    7⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Modifies registry class
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1760
                    • C:\Windows\SysWOW64\install\Svchost.exe
                      "C:\Windows\system32\install\Svchost.exe"
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of SetWindowsHookEx
                      PID:4864
                      • C:\Windows\SysWOW64\install\Svchost.exe
                        "C:\Windows\system32\install\Svchost.exe"
                        9⤵
                        • Executes dropped EXE
                        • Writes to the Master Boot Record (MBR)
                        • Suspicious use of SetThreadContext
                        • Suspicious use of SetWindowsHookEx
                        PID:5080
                        • C:\Windows\SysWOW64\install\Svchost.exe
                          "C:\Windows\system32\install\Svchost.exe"
                          10⤵
                          • Executes dropped EXE
                          PID:4812

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            3AMD6.exe

            • Path C:\Users\Admin\AppData\Local\Temp\3AMD6.exe
            • Size 376KB
            • SHA256 172705b8a6cc6ef666091f87dea13e6d77b1366458195909665e0086e0f8f77e
            • MD5 SHA1 SHA512 SSDEEP

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 56bb49d4b13d61cc9d80436cb2c93592a8157ed1d2ac10e5a18972c0ff64e257
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 00b2e73491874a77dac4e85f837880b6fd353dbb3aecbce3fcbb4819e900932f
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12b0863b21ce62d8b37cb7338fec2b801303834ef54e632759bf15abbb6a7b8d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a581c3feccd6a9d5318370a970cd59cd572577d2a28aa1e6772a2c2de811299
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0df12ebd00e7d8d00c37ff9999a52c64a9a6707b6167ce33e0a8804299ef7e4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce13a12e4e4b2bb114d053bcf5661f772d561bd6ec754b8f42f3ee6ae5ea3e7b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1207d287d5852323866c38990dd6b4c9ebfc0de663a8072b513f9fe3982f1bf4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25345901876613d5fd174e7748d88a5fdef1b473fe1c30297fd7e25b37268ae2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 970733e94285224b036774dcc09fd60160e500c0836c315afd1f305f31093f77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ae124cd90d3e9639f7c07f86664b899559330cde61f4fb4393edb7407d17d9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6f64e9c694e2ebb66f0c4b86e6b69ef98942bda865beb2aed2ba11668788963
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e47247a769c09da7603c53b2d1741ae5b3319a8fbab80e1be5f466ea14d876c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be6db4973ba361bdbf0fedb696a684bc8fb31442434e0e8f428770eafac3a03b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d892403f3f7874de7c49a4b964565c39667e9586fc35020ed9df58a9106fd637
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0185afa03dda92e6578a1fb57b217f84e492635ea68f4b95537bc4e04d39f30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 553c4c48c9a7a327d74cdfcdc2b29c01a354c483ce5e8726b597077c916af360
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51c83bc5a08d717adacac7d430dd0aa4b5db84786dce057c1d9a2fd606bc6e02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 790a7fd4f7df0a1a1a8ddc269717501f2cb6f1af981da49f633fcd40ee46be73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c284302b81043f7b1fda096e8194347609371572253309fec8c48df32ab0bca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f24f1d8661e181828e86c21d7413a928f3b241a8495b8637ba55421fb61a994
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31731bab02a8c7f240d2e58e023e965515405a1c577c90f78db388684334f6f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ae72d52fcd32e3de1485fbcae9f18b0dc527431effebd455fdb68ac9148a5b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6daf6254aa51cd88492e9afade62088b141b2418130bf90a9596c3dd24e051dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b69736b7a93da55345f348713db68248fedbbc863d9a9ee34eaf19a81230ff48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd8fa6bb1f3e38231aacfb5fd828d2531bff25cd5178bfe6c3bc226a57f72b18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e6e407e6fe8815671aa06d9b0337bd087ad560257129c9c367dda9ce08b3a18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2637ea72468be3a09f899dc0f8438712e5ea9e5b4a78f5b7fadbdb24049b81b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1edb627919e0aa5d09e67108abf83489e355a881f81bcbb0e15d5d7d19621e73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7578f37568b7c337745a13fde76e5b51a102f28d244c73d62c2e73b36067e715
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c28be74a75b837f95cafc84d45b8d52c5b31c8042407aa6cca2a112dd818b501
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef736a15b8bcc387eaa706fb053088f3b20b4acbbf4945fa7903e93308f2549f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35e15e2f0a0502c8abb527fe32d75f75111fcd8b2d12c0be9041c06b0fc173fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a2c35b0fcaa0a64a68570428e0c842790593da2ea66ba8a8edcdaf0772a41b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82e7169e7e81c3da14fbc0d324a5b176595f095df8c2a4bbc8255e9120434b6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1f054ee366fa545dbc221d6406730c5507fb5bf83a4a0929e69e5746aa74cdf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a110e1ba4a9fd42f22272558730fca2efcbafb77b319a477dfc5c56fd7a89410
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a680a5e8f6a43169e4eeaf314dcd7aa9d6db1eb1eac68c79df53b3aaa196759d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09f1fe3fa9df7e0411f2a739887244fc70e919ab7796c38954844c61a4d6742f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c939aef0a3896e52c2ab5f1ba39544765b7a22e4ee7545c4dadb85bd9f98d5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6076d4b1e68d12989b44f0d8faff769a9063603ff77c50064e70ef2801301ecb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 264254e97500315d8290e4d8c5d47f02f4f719a39f6997f85b1a7889ffd3b86b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2399b31f276ef8dfa83e8ff6d3884b1754e8c0be859962cc85dc49b22ae5826
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5ab69fb4ef49aee5700d286b302b113645c4f48a3553f56aa000d9eba35b3f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1323c449ac4c2069891132f46278c55e0607f4776acbe66e0e89794f696c37f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19cf7bee6c910ea49d31eff45a02df92798d404ffd83b79e18cedc5a312374df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dca1ec3d49b579ae3f4586b2f41be3a7460934662f27b008844bbbd8396d1ed0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88ccfa6ca7cfbdcaed98cd9fa524a126a685ee079a0387d7edacc7e7f71973ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dff00a0bb0736a2a73631f28db24b13b468e47fcd83cb303058237f493d6b64d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee82ad5f7be489a20717dd94d2b9399d6224c26903aa0cad66f0458fb2c4ff77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b3b7d2c10f19f821f9a837cb74f96bb0db8d42f91a998f4f5557e7f8e9b39ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94417faafd91249bc2a0b2aff95711a5a03a9834cb6c70e4aceeb2f76ac6ee3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54f244e4ed4dcc4117f992d75439cff3651b76a6dbbd8e8ddcacdba11a8e928d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d756f57048dc27594350ffd76c3760fb5c6483e90998b9aafeb33b40183e7530
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c79f47bf5edceacd41a3003913de901813e6e4a384bb15446e9138e5998ca5f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0550e3b92e17c480c917b7695dad00239fde5905f42a1050a3c73e638bdc0ef7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3b18328d0849c19d0d6306279de3c7a0768785a07648cefa792877b7672b8a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e1e8bff8e05d23e40dcfb4a110faa7f7025728f873ae4b5d35b1d6f1124fe6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7147aad3076c87055a34fe4837445ca8857d1007b19fadcf97be2d86a3e65134
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c8c51be37c5646888cfd9538a0665d89c5868da6ef8f84ae91a8bf3cb16b7a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc51ba18b617123bc7fd7ac8c6e09265797a5a9ea34b0ab9333b06580d5b421c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e87d38832baed774ba16d637a32687f453ddef162e0d53aff1417bf908319d23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae85a676564aa5d2dc054939eab79c21d5030ee94cca4344cc0abf232e73ef1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f3da5cb0f37630f43708113dec7a517a0e421a6200f7b2882df82b06c7d3579
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f28eca73a2e17951ff74448c7ac513df1b6a9d35488ee68785d397d8411b66da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7201a4cddf9b8f060e44aa22dfe32defb85522205e88a8b3aba2e885020363ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20162767cb7e05db5f9a5a48853b0684a6a6986c90b4e6d0de10b69b04151f05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32754812c27d3d676d2d4b7c29f3088246162e69e8004f6e9f09b2d3d2689679
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d07d13bcb983deb012db1bcaebde29a40a52f1c7ad80b4288504c6c25e6f81a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b82f829d821a26f235d3a4fe7cf4c9ddd65631ebda35702356405377ec4d43f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c9557bf30355b1cfe617f48b6f4723a10a835ee0246b0836a4cc4a5b6ee4b18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 682113806df933a8ee185fd43bad3987784c299b08b56dca19602bcede90d6bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0302198656f8ef6af58ad84de0bc62b422fcccc324ea3df306b13e5b57684f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc3fb6c81199de2d8df448d6167dc9569c04d4bf2f748d64867c83bebd2daded
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b0e2e07f62e3f92d8c569ed366368ede72209a143495bb9ce78ba5eacf676a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 880b74639e5685436e4a0b47d3317e3fc6ea485694488c2b9037b308643f1f62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9469b453119311e528e93556b740fc4cc1bdf7ceefc43b49155f2eaa72b2a81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd7d871c7bc1bae4a810232333d743db293baf03bb157a3da66fbed4eeb1d053
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb31b31d234b71cd67c12254928e10216ca675576a20d0427cb555cc37104d31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ae8822ba0be486f7eb11705849293d6b33468694adc323d5169a2b1cfadc24f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8aac0282aea90c057806eacd4ea009b06a010475e362c96b0dc40bfe11d521ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86d9c27049bd6aeb97c5c90ef3b501ba8bdf013dea166995218cff8da24c7a6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7509a37a3d83850150d76197314326c8c0754b39987f2b3f8eb84e478a7c337c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa92e05d9df4906d58b17c526ae6d05a9cfc318699aa61f62c8e07a82eab945b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 804a371509ea4be1e7ee2fed24ea00b5c95b9b0af93e948bf2ab178a433fd9d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 796d52f6aeb3c59131e14342dd37813e662999226dde1a419886a47936bc862d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eef26019d6d4eabec531a2229551b63b6eb4b7f27494689e95769e94b2f67d94
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 506822142b2b6f68cc713a60bc27bd888278e96364596d686368048f1e82eb3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c491f1e1ec3484e08ed3ce71cb8ba3485316ce05f188c2973df1902a700aee4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 160ef4c1d786a66b7dc39e2736405d81a4396e59831512814395c86268e640c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73454e9434ad372f6cfaecdd767f32f10ec9433b64c68e7fe5287e06a2f38503
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be8191dcc293df0ecda4facefec787dc73de00635ccb5bbf322c1166800641d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e83671b5dc42467d6eceff459a2d03cf695d7c95043bdaf1fbac890bedf50530
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7be76f5ae94f254575f25768c9a08b7c6d58fc7891e4a026bc9a7f408d7d9f78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86740633c5bf45d975343a2250498c2af95e8af1fe2e3b0487cc59edab2ff0f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bdeea83749258fca9387cd7eb1dcfb3b379067cd5fb7e38ccca8cea6527dde1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e0d2ce0e62be1805b6c9a15e537cc5f8b5ed011b002be302ae4f8b2db11ba5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d850eb93cfc054aec22e653c36b3c91a1bce0f21b6b454dc74be6da158f0eab5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19d37cc4acb97e7cc98f68e044f4582b16783ced76e7baa1796081c14adf937b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b8d4f680e04779b7c96d63eb5a88160d92931a26c8e2a567917c8331f042297
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e46ab3a335d1020b225306526a953ac446ccc7a7679accf6ae8e528d88e328aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2579d21528624bfcb638056a7b817625f471e63bc94bf86143c02030948fc69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1dceac10a1bc8f515bed54dcac70c1d05cb375057ea564e0e87e8287d24b756
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f22da8202cb256f2e5f8e8b582eb846695ec555caec04eaae307d698346b60d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 895e84d727df7fc9a7cf78622fa83a6076b25c530f29c62464e7973ddaa35761
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1689d905d02be246f3948ff0de902e4adefcc68728ce03c731f78ef1f64e1bda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c3e836fec4120e42f65de07a5165c074cf735cf8894d7f590b7689abfb32fed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0638d1681c23fe1a56bf3ad323819cd5dd07cd20ba3fa836dc0f9abf381da70c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ede988873d463b308c6d52c57e19065a42be29050286461ecb0b7a858db234e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f00aa05533f13c73ee1771b48e743cac906c02e06a57794a0804e3cb6f7865f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 031e63096affebef908ca71d12f7875b75363c2e3dc21f1f7bc892c02fa33b0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed7e2a563430c292e0e4349a54c1d802e4dc1d2c5c22df92e11ecdea2039dc71
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a09be3863d8a812d8e29abb354c3d594805969a3fe816c5f839cfa472c97ebbf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad2b81d5a1b5bafbb42ade739d82987ade2a8296ebefe66023d28ae758f0938b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 484198319ecf16393c1277ca08efc582b431c7e27ab5663fc05967f4a43f88c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbfeec251e7d222ba7e95fc606b9fb7c1b1223f5de628ceff8af8a5e605a821c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bdc7d76aa2ee70fc9f08d46ddc32100fa2fa6d5bb69e1bcd8421afdf17660b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e980dd3c7e53a0f19c4b05fd16c882b3ba8104526ea9a7533f5285b4ec294811
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 681ed82925c2768f86596c74deddaaf55fdb4b960a362f27209213f43c475386
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4383c1be0211d113ce638fbe496dbac2d6cf0d2e0a5e0a50aced1019d96ec352
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5ae99421314a477d8136cd953045a348b7c742597d6eb25124850c4ced424d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b52c9e210fc4354c364a204b8fe400e64f97b1d6434e757687dae61cc14bdf1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce2f09b6bbd62443f3aa08b363c8ad0fa25e5824a32f0605b4c7c5d4b712d292
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc345921eeb90d42fb061288ae79f5a99df356dbf8b33e692d6f586157dd4f72
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a654121fafd9295c2d77f6f506a7e5719cba5857d898c5a47e28ab92cf86b876
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fddafbad2caf5b4c198dddec98a80d108cf52d8a0a0d301996252960ae3eed0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c0357769c414644d27840f1a710719d9f3b7886f2ed5f02bffba5efc600be7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 773b2380c185bd1da932d0833b642ead0b6f1b9cc2716514e56fc87307a27314
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 214a0b805cfb156a1f14ffb3247f04001908dbb86a62cadfb3cc1dd78bc8a431
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 945c2555a035ba32141515865e682b9fa2d32a8f8fef2126c681109e7850f364
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9e49b83ef721f345ab9870a212a6b76ce91e980a4930a547ff042c9cdedeeb6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bed87048562c0d946927cd15b061eb657e31546304f5aaed0ecd0f78b3902ac2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0bf14a8ea53fd8db1f7a702ae8d9545eb809c11ccf8a49d834d4f7afe6fb5f77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 477e391202b3e1c770589d92efc3824ceba2d6c8dec361c3fc7b0c5b7b1413a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 971f90e103e3b6461fb38c822d9625801f979547456099d899111253d5dfb1ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42cfc075029ffcc1a32e12301fd9dc175ef864ca9d0332a420bc359cdc60a556
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d3f1c457cac1e88070226e1199ee3b5b852158b8398613ce6b8488cc0cef87f
            • MD5 SHA1 SHA512

            camfrogpwd.exe

            • Path C:\Users\Admin\AppData\Local\Temp\camfrogpwd.exe
            • Size 16KB
            • SHA256 71dff5e0272a7dfb83ee4b149fe0eb568f04dcec2dd21ec87f93ef5bb0380a6d
            • MD5 SHA1 SHA512 SSDEEP

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            memory/1584-40-0x0000000000400000-0x0000000000453000-memory.dmp

            memory/1584-44-0x0000000000400000-0x0000000000453000-memory.dmp

            memory/1584-37-0x0000000000400000-0x0000000000453000-memory.dmp

            memory/1584-33-0x0000000000400000-0x0000000000453000-memory.dmp

            memory/1760-188-0x0000000024160000-0x00000000241C2000-memory.dmp

            memory/1760-1319-0x0000000024160000-0x00000000241C2000-memory.dmp

            memory/2556-27-0x0000000000400000-0x0000000000471000-memory.dmp

            memory/2556-6-0x0000000000400000-0x0000000000471000-memory.dmp

            memory/2556-3-0x0000000000400000-0x0000000000471000-memory.dmp

            memory/2612-411-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2612-56-0x00000000008E0000-0x00000000008E1000-memory.dmp

            memory/2612-116-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2612-55-0x0000000000820000-0x0000000000821000-memory.dmp

            memory/4640-189-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4640-41-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4640-47-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4640-43-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4640-45-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4640-51-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4812-236-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4812-229-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/5080-228-0x0000000000400000-0x0000000000453000-memory.dmp

            memory/5080-219-0x0000000000400000-0x0000000000453000-memory.dmp