Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/01/2024, 00:59

General

  • Target
    75f82d64f52c8bd1e53c1d595ac00fb5.exe
  • Size 796KB
  • Sample240126-bcdadscaek
  • SHA256 0c1f49c73408123a2968fa55b50fd34757e33662d9831bb6541a2d05f9067369
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • adsll.no-ip.org:81

  • ncn.dyndns.tv:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    taskmgr.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Disables RegEdit via registry modification 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3392
      • C:\Users\Admin\AppData\Local\Temp\75f82d64f52c8bd1e53c1d595ac00fb5.exe
        "C:\Users\Admin\AppData\Local\Temp\75f82d64f52c8bd1e53c1d595ac00fb5.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4076
        • C:\Users\Admin\AppData\Local\Temp\75f82d64f52c8bd1e53c1d595ac00fb5.exe
          C:\Users\Admin\AppData\Local\Temp\75f82d64f52c8bd1e53c1d595ac00fb5.exe
          3⤵
          • Disables RegEdit via registry modification
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4712
          • C:\Users\Admin\AppData\Local\Temp\75f82d64f52c8bd1e53c1d595ac00fb5.exe
            C:\Users\Admin\AppData\Local\Temp\75f82d64f52c8bd1e53c1d595ac00fb5.exe
            4⤵
            • Adds policy Run key to start application
            • Modifies Installed Components in the registry
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3536
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              5⤵
              • Modifies Installed Components in the registry
              PID:816
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
                PID:4432
              • C:\Users\Admin\AppData\Local\Temp\75f82d64f52c8bd1e53c1d595ac00fb5.exe
                "C:\Users\Admin\AppData\Local\Temp\75f82d64f52c8bd1e53c1d595ac00fb5.exe"
                5⤵
                • Checks computer location settings
                • Drops file in System32 directory
                • Modifies registry class
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:1068
                • C:\Windows\SysWOW64\install\taskmgr.exe
                  "C:\Windows\system32\install\taskmgr.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of SetWindowsHookEx
                  PID:4928
                  • C:\Windows\SysWOW64\install\taskmgr.exe
                    C:\Windows\SysWOW64\install\taskmgr.exe
                    7⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of SetWindowsHookEx
                    PID:2252
                    • C:\Windows\SysWOW64\install\taskmgr.exe
                      C:\Windows\SysWOW64\install\taskmgr.exe
                      8⤵
                      • Executes dropped EXE
                      PID:1156
                    • C:\Windows\SysWOW64\install\taskmgr.exe
                      C:\Windows\SysWOW64\install\taskmgr.exe
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3064
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sil.bat
                      8⤵
                        PID:2776
              • C:\Users\Admin\AppData\Local\Temp\75f82d64f52c8bd1e53c1d595ac00fb5.exe
                C:\Users\Admin\AppData\Local\Temp\75f82d64f52c8bd1e53c1d595ac00fb5.exe
                4⤵
                • Suspicious use of SetWindowsHookEx
                PID:2716
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sil.bat
                4⤵
                  PID:4860

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                UuU.uUu

                • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
                • Size 8B
                • SHA256 91c96bcaf09f960a2dbf4906a9cd77f9fab5d70b958fe83c8b21c42315dfb729
                • MD5 SHA1 SHA512

                XX--XX--XX.txt

                • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
                • Size 229KB
                • SHA256 5d86ec26a0b2320a160b8fa9e73b5cf2e6f2cbd8e3dc4c9d44a749accde8e80e
                • MD5 SHA1 SHA512 SSDEEP

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 28cec1c8406cb590f2ca2b4500bba7e2cfe608c001a91ba1c7c1d592fc48cf8d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4e3b0b667735dc9ba6d3e805c0c706d097500517d0566e5e68cb852625318e77
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 03b1b9d93196f273e4e750026a4ac7d15699838704dccb1d751d451b3293a02f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ce2093b66099fe82bd347d9122520b8d23113a1cfa767bd15d8a04c4d7299a45
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 017355f57e25d6687a9e4b9f55abcb323ded05a98ed4dfc2fa748f0c6d3544f0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a8aeab35894197e62fbf7554f7f020ae4651008ab072b6e5d0a7bc706ad74188
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 32fcf670c7f7172e4ca5f9141a02de36f10aaf3bf422bbdd014ef99df0a2b08d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 842d1dd49a0152e246d3845a422dedb291171074c56a72782dbcf124d4226f4d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 497b8a72c08ffe245adee8985a29071a69f693019994ea873a63fe07cc65220e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ebe3c108543a8c210b8849d86d6dd2da2b0423554714e51ec36444b23cfd4d1c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0caac6b704a2b4a93e5a89f4439e06a2f2055f60ba0c5182b842b1fc54bf4828
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 35b83baa2c6579f314d9f036d78dbea49ba1f653335f52a75598139ccf437bd1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 126e713d1b5718f92a42c51795ad965bd81273228e0546d6064e903525d0f878
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ee69fb54ec4caab9d43c235f793ce9d1faa267a41febecc352b60ef9e95553be
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5c2c6e1f1ba87e9850ff7b90b39aa571a115fc568d75fff9f07fe2035b5f1dbd
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 19131bcdc634790808f83ecae406db44347c88a0c93d7ddb271b3c2cd075b9ec
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 42a7bce98a274386baca98f4ae32794e58c9cf4e1427184c600fd066e1692839
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 82654036d068bc066fa9d06a498347a4f0ffd6ffe841584314cef5e99d3a3ce4
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 06476b144ff4674c21d7a66f41d179a4e2895eea8954b18a6eb4724483407b4c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9423ee653cb5ccc535dea786a62ea6e68102b394f336646481950d4a95367705
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8db1e1de0205f331bd23ade2a5be045b8f4ee967cf59be1a3272a2b7638432c1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9247d38834600b5d46cc73e5f78d0dfdb2a191de25c74f8ee8339776eb4353a6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 14cca4e337584a44a1d2c369c7bf919548b9f657d7019b43bf48e9905080b077
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8df64d88b1961c732b56a0713bf7786182a55bdc71633a4fbe25fef97a335ee1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b79e74830070dcce79fdbf21f1780c98fcd2b7deb3ace0517f4d06bd6d5a2327
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a740bfc410655e53e47aed660e29127ac88b7d6d74ae13991cf28d246f71b912
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 643be0896aa8f282f68096945bc36edd4166bf5e80adb6ab7e0dd220ccd5c220
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b76d591aa1835a6b4d59142f3feb4e4dce366cf38f569252a2ccb0f689e2c57f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f2eda0d74036fd6123696effd5204fed08790f52be0b7bef616604ce55626133
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 27a047f0bb178be4065c233c183e79cd96ed1a4792e27c2358bf641ed9d15924
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c113819c1dd463bd11472a5385dc76643d1db387b55a73f308041f45dd8da8c2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ec65209a4dec42958273eb7e60cdc2cab4174981e9fdd9703af234a3eb9e038d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4d2047be3ff9f71a429f5363e55275cb25052bdfcd1c40acbb1baa0e43f21591
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 52831e25d4b99d6dfb74e6bc5ceed6546b9a53c6d37a8b5a88ac68f73328f653
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8aa4ac31a41db2e0f3fdb825db4e1297202c31b19bf8971f238f4a5287e5e24d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 32228764c8a1c938d6b3d1e768e5c40df7f712748ca16e5eed940c4216b617f3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 68426f7c8f243ca0ab59c22805908661219d4ff0e32ddf7de0d84f2384578663
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 94959bbc715849fd30d119597403dc3c87a44e31e02d8de88d4bc36e83c6c9c1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6dbfd092799d13cf1079f7eba9b23912ec4ddc3e6a0b088b4807b4e607f2ee5e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 176c55c39432d5e33093033a2c5d220b2ad8a233431a4e0d96a4cc5bd625231f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 26fce1a5868567ccd0fe950372cd10717ad49e61940b9806c755b3247a516d23
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 de60897164fa89d4470194ecbb5798c33501923b910372eb45665c236b8a65f2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a47c76f6fde21a85f0230f1474cd6dd2a00382d05af0fe6ef77ac315612e32d2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5e6d5f8a5fd482bbc5ea0a736e3dec29ada7500d20075c9e01142da8ee059e7f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f3c3f7495b241d0f0a403852cf70e3e633ba363fb39bab4b577fa3f44e0baf63
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5d6f2268b93c4c387975966c85ea6c8793d35326026b9bb28bc3d896cdf0edee
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ba8dc3b7c34e09653e34560e53bf9a646115f7d72481bd91d95f7c9126b007ad
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8f8be85f8c69c9d1061cbabfb42cc31dd362780460a037f6371444291ba17975
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0d5fca83b81e158c6b90a8af72eeff425c0512bcaaa57242f7c02d0c0deb3ced
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 34af4809d89bfc56986d316ed4c1aab0998550115a5502b8c4aebf597a0fdc1f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6687d5a906c0da59dd3d0988c6c220af79ff0f96e19fc390b747493e0b8884a1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9bce95cc3eef88d28e8793b01b4caf8fdbe7543ffc7c6caca0504503ec4f7e25
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8693cea22b6f3c6ae83219bd511aaee149f57a588f7094bca44e657099b6886e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 50da8e6d86733d041eadcb8019b50ab8e9dc94636352f50addc56b1aa0355495
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1fe357e7f77e06c8c15f132822c9116087b1942a764d615a402a480c436ace08
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9f42b082586ef9e703d46585ad6ea83ac16b6b0a3258745d12b7031a359feb14
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 af8af65e5830cdcb70558bc260562b537c8b075888e80f438348680bcfc5b42f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 81badb337a43c3394dff2b10d7909ebad3db2020eeb37634b5e26032fec7135d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 da3470c58a721b02db6375c0ad139b003b3a8b59da46271d233f16ab5842ccbb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 56e45f07b68fcb996d0c4b5bb5e9ef21eb210aac9b5f2091745e3d6b09242e96
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5c624a120115588a8677a1e552cd821320f1c19387ec2388471a494456b05927
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 3a8fdab5f76f3ab954e1d2d0ada2d136ea0d4dc61b1cbf70939e35a07401d474
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 3b771091e6865b71949e34241a785372d34484636a2df86d7a9bb58e4e155af5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 efdd6f53a39ec92e36a5630a5241c8bff076fabc30cbe502c5b56e9d2a8f7031
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 185b25143fbc8a3eabf4b3d8e0697212a47d5e91d182b32d17f856637081de69
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f1e582be60de91f4b5d59bd78456789ba2fdef6f3b2d0a7375207045ca5ba4a7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 63deb828292cbec7c0837c5be6e67b98c4032bcd7e0d7a98a585ea76dfb2abab
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b070283a0ffc5e7c4c933e4f4e7c7c116b1c93a07c57e4b4c6f3c7aec13cb89f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 500c83aef3c4986d93fe34b46b91437bba919132e414a6577e2023f241398ee6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 46e74eeb0febc490c005c3bfeb16040163214013123babbf73ed6d73df71231c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d8d5a9c85155c53f7a82dda32bb094745d2a106f797e2fcf397429ff991e9fa1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6a9ec652de482428230e5a146311bab1299ac35c0e9f8d7989b06cb0b0466e43
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5ad43eb4255c34cd500933f46e4af25fa11168f0466716acd43d6ce04bd750ac
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9d94bfd1ac311d60493a4a935bf6600b1117cdc738c63e2ded2c7bed4032a7d5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4fe0bb159f5214db8877d6b796aec01dfa888d8848be839857b854111093ccda
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e9daaf27f426c136f75009f87224472dda26e1fa2f760af2501773f1436caf65
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b794e0896d773df9b5d73b12f9df961cf0d3c20cd7bcdd7139239c50a2f4863e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 10b3f310d5e5fc14febaf8f3209bb120b6e94d72b3a8f7d1ef14c5589c232cbe
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 91f0d2e077069dc8d32c89753ec63f891309f2a744e6fcbb9381b44ec59fe38b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6e3e161e05c07c6ca07a1527f324cf3dc514c3d37d4a073b0e3d480145ed5f03
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8a7df3a8f5df7bfac50ea163d672e9f748ed737b0b0baf13882eb3bd9e85bfd9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9746836e834e0b6777520a11dc4d700b8b7ed39b8c72b1d625f856f85e5571a0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0fe35800ead601e6effe39ed3d339d93f7c0c1b0dff1c9e2f144c914570dbf0e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0e7cdf9868ade2ec92d7554719c987663a914d353b6a4be5e076b35e5a9127d7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 eb6c376dd8804bd71aa362f22edc62d0af008ee2097b86660659acb27e93b463
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4defd57b912980f2829c9588d76f81063c3bbc2049bcca0458df64b782a51730
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 27675e14397365ff98b90a182a9512049ccf96e10b3f9fb5b56ba2bc2d6e4b53
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 83de6d340158b5409598f6f3995c52afeb4b8d17ca501a5fde33e435aa349304
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c33c7ec978168635246057cfcb6c23d01f0aa0dc1fde9a482c5d6d2f85227050
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0a72d447440c663824d8cf38f4bfb1491c8e8b990e0c9ff74d20318acf9cb1ea
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e1c001aecab5eb8b38eed5126b5f70ce1ec0d53c364f2255b6d005f8f362ecf3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f56e22226431e576de7d817586fd89467c957675fe7a77e0afd212542b5e2054
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5cdeb8bcd3a6b9496a09e681f32b22b637afe1425f207e663debdba57222ee4c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a45af1301bbf577b1e58d9283d88c516592048b7dec6210c43c6bb4f2b5e5c2b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5a66e8442c9d3544573f8ba9f8b5f69beb149e33b32c84d3fbf4257106a80b67
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6ff10ced3691f319d227f289cf295415fcb68d0d3838115de6f0560c93b5ef21
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 50dcbb790cc2eda5c57e55621e95081d491eb21ceeac716893a23e110e117b3e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b8dd5c4bbf09c37b845f05fe45d63ddd8ab3cea3f3236a59c9de590360ab1832
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8dd2fac37d2f3c276778045785c769d40056506f6f877f7d3f34997589850ee3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 054e58c245ddc012958ec93825cb77944bd61bc4e311359d1bab787f2448ede3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 33799b467ae38fe48712fd18d725243223044a233968a105991c84b4e6186dbb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 dbf10edeeb7401ea72d6cefd0087f098fa8b146740a3e1cb05851260af932b28
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2f14156385c0f94c1099ce42354987eff56d402e2ab95143daa3c921af5f91ff
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2be74ee058546592e9a6fee9a0c70b7b59639b9dcd949f8e361a726c007a88a6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 cf298f3e46870e365f074f4b6a562ffe696569ba0c042954d4de9ef0747c537a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e1bca29dc85444f5b70a89eaa397c781e942b9a1b655b916b84a3a817f7643fb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 eb380f7d2d4ff1a315d656da80e0174dd2e165eaf18c0efcaffa3024cdb4cce9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5a23519913897b03a5c9df2817ffa812231f74492cf8fd5d01a46d3567b2dd77
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 59b7ff3b1c2511574db63f38215d16015ce5520a1f91a1cacdb4337ddfcb1324
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c2970a50fd6ee60c0d61cac62b1d7a3eeb4b468682c6fec5e3d505a12b4a3ae9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e8d16ae512580bba491b71a0ab395fc5619b0fcf8e34154f3e04deef3b00d1ab
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 47cd2b5e6ced75a0df6452726bcf166a051f98919bdc3eebb4b57186923e3359
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f0a4faf9c429140a0de3c9ac6333c430995e1ccda92a385d46fe42a447da038a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6cdc730883fd9feec216a64b75d4347ec2f766ee6e4beec68c401959b7b39927
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a9809ed63204369e5586fe4fdfba67a86709a24fc8be4d2e11920c01e2bb030f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2e669b279976e9549f7d124a43442ccbb74ad5743413f81eddc1d783123eb964
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4165d1c4a4fd22f5285e19ee657ce8058ca18ce19f51c2b554b5b12601ddcf16
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ef1f4bbf8294719e411b7a4dd6d89e276ef504eb5eedca6d46847214635336ef
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f92356dc00ff3a045320c481bcaf190696f7dc5e1c40a54bc4b9153f8f4acb96
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9fd63cee7963e9908efa0a88c488d2aff1ce3f94b7cc701f68d49773a7bf91f9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 036d692ace511718d3ef1f3517db567d0c98b65dea954930e232171f01d25e5f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 dc6a1c43626488970b799197f3dbff31a75875f19f3312b5590001d8b5ac7b41
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2e4519756182ba3168456ff2b38e3b316f84c70587a0175ebaaa79ca14d0a9c3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f7f90a64904ea62b0c33979c23fa978d5a17d33cbeaf92ff86a9efaa7ceb618e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4096771bc4f6ae8501c727de54c68bc0623c657911ef59a8533d5e8462aac482
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 98e59e2dd7618a1c567df554fa4866f7ae38e2b1eff305df260ddd658b7718b6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 cbd5dc7c2d3e452c3accea1d5abab232888211e7a175ddc39f5714d871bd8808
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 90b3ce2bd06ddb211cd6fe70fa3a32e819fb8ebf3fb00394b5b3abdce60ab96e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0e21445dee76f3b39b206ef92c68d13e65ef182b74be10f0555e2dec94fe7bda
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d8c526eb5008d0a4da9ce11d11cdd7862707cef26a6c2b7fb97d71e51e2acd96
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9fb9b0f2810eaa7063e64289b954f5d96cc256579ea43ce9536ffe96770ab200
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 347a7be7fb4e2603fb5471e268fd646e7c4c18e60b0ef3b3d740ce7829cd3ae4
                • MD5 SHA1 SHA512

                sil.bat

                • Path C:\Users\Admin\AppData\Local\Temp\sil.bat
                • Size 406B
                • SHA256 2ecde02f4758f3b83360ff75edcf9110503364fdfb6f3e612e3a089340662d7b
                • MD5 SHA1 SHA512

                sil.bat

                • Path C:\Users\Admin\AppData\Local\Temp\sil.bat
                • Size 234B
                • SHA256 675488310be77fd077460b6d9a51e1e803b6f9db52df4251a1b61f6ff50c9904
                • MD5 SHA1 SHA512

                who.txt

                • Path C:\Users\Admin\AppData\Local\Temp\who.txt
                • Size 240B
                • SHA256 651e675c783c4345567fba8bd45ab8d402967d08b5995889c1a45ea57ffcc5fc
                • MD5 SHA1 SHA512

                logs.dat

                • Path C:\Users\Admin\AppData\Roaming\logs.dat
                • Size 15B
                • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
                • MD5 SHA1 SHA512

                taskmgr.exe

                • Path C:\Windows\SysWOW64\install\taskmgr.exe
                • Size 796KB
                • SHA256 0c1f49c73408123a2968fa55b50fd34757e33662d9831bb6541a2d05f9067369
                • MD5 SHA1 SHA512 SSDEEP

                memory/816-239-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/816-39-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

                memory/816-40-0x0000000000F80000-0x0000000000F81000-memory.dmp

                memory/816-100-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/1068-171-0x0000000024160000-0x00000000241C2000-memory.dmp

                memory/1068-1325-0x0000000024160000-0x00000000241C2000-memory.dmp

                memory/2252-202-0x0000000000400000-0x0000000000491000-memory.dmp

                memory/2252-236-0x0000000000400000-0x0000000000491000-memory.dmp

                memory/2716-22-0x0000000000400000-0x0000000000427000-memory.dmp

                memory/2716-20-0x0000000000400000-0x0000000000427000-memory.dmp

                memory/2716-26-0x0000000000400000-0x0000000000427000-memory.dmp

                memory/3536-34-0x0000000024010000-0x0000000024072000-memory.dmp

                memory/3536-19-0x0000000000400000-0x0000000000450000-memory.dmp

                memory/3536-18-0x0000000000400000-0x0000000000450000-memory.dmp

                memory/3536-16-0x0000000000400000-0x0000000000450000-memory.dmp

                memory/3536-15-0x0000000000400000-0x0000000000450000-memory.dmp

                memory/3536-14-0x0000000000400000-0x0000000000450000-memory.dmp

                memory/3536-12-0x0000000000400000-0x0000000000450000-memory.dmp

                memory/3536-10-0x0000000000400000-0x0000000000450000-memory.dmp

                memory/3536-9-0x0000000000400000-0x0000000000450000-memory.dmp

                memory/4712-4-0x0000000000400000-0x0000000000491000-memory.dmp

                memory/4712-29-0x0000000000400000-0x0000000000491000-memory.dmp

                memory/4712-2-0x0000000000400000-0x0000000000491000-memory.dmp