Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/02/2024, 16:39

General

  • Target
    927d24874758f246018fa82540e8fa6b.exe
  • Size 540KB
  • Sample240205-t6dr5acce3
  • SHA256 cb8e8c24ded4a9a805a96ad65b0c9c7c4d0854b7f2baec567c6deecb3b3a6082
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • conectorzero.no-ip.biz:85

Mutex
  • Muerte!!! xDD xDDD

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    wn32

  • install_file

    notepade.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Estas siendo Hackeado por xana99, disfrutalo.

  • message_box_title

    Eres tonto?? Acabas de caer en un Hackeo!!

  • password

    zero1

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3412
      • C:\Users\Admin\AppData\Local\Temp\927d24874758f246018fa82540e8fa6b.exe
        "C:\Users\Admin\AppData\Local\Temp\927d24874758f246018fa82540e8fa6b.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3924
        • C:\Users\Admin\AppData\Local\Temp\927d24874758f246018fa82540e8fa6b.exe
          "C:\Users\Admin\AppData\Local\Temp\927d24874758f246018fa82540e8fa6b.exe"
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1452
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            PID:4604
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:4144
            • C:\Users\Admin\AppData\Local\Temp\927d24874758f246018fa82540e8fa6b.exe
              "C:\Users\Admin\AppData\Local\Temp\927d24874758f246018fa82540e8fa6b.exe"
              4⤵
              • Checks computer location settings
              • Drops file in Windows directory
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:4860
              • C:\Windows\wn32\notepade.exe
                "C:\Windows\wn32\notepade.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:1464
                • C:\Windows\wn32\notepade.exe
                  "C:\Windows\wn32\notepade.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:548
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 536
                    7⤵
                    • Program crash
                    PID:772
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 548 -ip 548
        1⤵
          PID:4816

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 1e23fa44c0ec6238b738948a8d6e9fbdd7cbcf4ecf24d5c3e53a4d2b2125bffb
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 236KB
              • SHA256 640b02e04af376c64897c21c43fdfac7795176b58c33acd1f3a9102a4ab29d44
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8096750dfd3890f4e9d0515f9b93e22bbde7c4660bdcdb21f91071252451204e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a5e886f2875499107d7a67a500e7feb82106be7a9f5554b03b26b11bf5171cf6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8058279aa180900fecd17a3a03de04942965e624f7d0c0c84037ee8e6acd3d13
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8130eda03bda6e9811fd1b1d07312f984e13265942b8b79cbb0bca2ffaded596
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 21243bd568313603d0f5abae07243242297ab86800b547e35bcb32f5e94921bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bc69ff3e0df2f4fac62bd5bfa9495687a44301215a9d4ea4f145afbd2f10b4d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f17912e029d9d860c466af31d217b98baac77dbbf8f47ab6f19615ad9eca745
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c30e14b87bbe4a9dd3a04b55c55b82609f7bb70bb8c1826bf435a32d09feac21
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 837c937902b90227f1125ae4d6d017ccdd543b0cb13f1826c533f6ddd8abad9e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d50e7b01562a3b7243a6415fb21b7ffca0b2fdf8833ff5119fe7bc04ce92a9a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 902901a24d1f35616a01fb3b3afd797d2daacdf6fc7837468b0debbaae6b7b42
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b5d72b6820cae2ecabef1bb55b23177ea7cabec182c5c3ea34950d407c94d1b7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b858347cc034d8585d672e898d8672701300550bccfa55f7972d85b77063d510
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d04734bc5e19efe4af349131f99289b7a82cd04d277073ae5c2154ff6d08b1b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 263ccfbb812e56f2f88246d9a50e37a1e467852ed42d816cbb3f19c22139d37a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee195738d4f76ee605f6347b43e7b7ce2260d85976cc65a517f5583aa900b102
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38dcc87c9f1047fd0ba9582cfe803497371ba3c8dd979a7f179ff5e77ffd862c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a58119e710986f6b558c54402729c9ad09545017c2b316e067322841db8b7bab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c78eadb7e8f42ed396f6992c8e2c5f300964853ce0c39fa9956ddf4f9af30f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7be06ff5d58fb0067c252277b59103c0969740494df1358e4c190657b4550153
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 143eed968ba60192ae1af64897d1677726bfc5bce1be886deda8ea7150b7a19d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73bd748ab7fd0a42c4ac4077b7fc1c328998ceea09f7e788ab61d8330a5a9a82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c142b5eb0257dfac281237c7797c509ec8a82f12dd8a38176989516c1ada639f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f46eed1c3028891b877291c1d2b999aa0f12e075d8f7dd2af5bddedf34c07e05
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cfbd853bedfb07ef0dcedad94a99ffae547105c4547a5dd40b1b7c1f3030e100
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 956ea4226a28ef104613c7c3b36deeb32f5dbdd9a47c48d970f49b50601feb7a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd9cc59cc9c3477d6d16f75b4736881748879d3ec015e6d20e79555598be36e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 76b0cc5d8acfc80a72b1f74a440303a0df28f1d40a331c37e93d7ca12ca96b62
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cbc220a9d82967089b1a89c7c750bfe48bdc8257e9c718996f796c3e90a8c9ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d578efc99e906395b722ee29d3d186ecb71157ef90fcd7a7cebca4ca73e50fb9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65fb8e6442408162e385924e0a7a042fec94ec992cb82ea0371e5af2c01a5afa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c4f80f2a4fd1457574a0578971a49d6a009536faef498bf131d2031561681b53
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2a18214447ee15316a06440bd582295eb2ae1780d1685ad204aa0464299653ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58bc31e4106cc9e2ad6f0cda87b993a29da42a2920928754187d68a074504f9e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7f50e9dca1b0478e59efb6cdb7c3f3624886e3974b27a22118d31f9137660bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 363d5baf2d7f4bfaf462e08530171178065d417c7b19a4bd4d8cb38a9be4b058
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b32e0980f6fa332eaa82e690d4c738e7def7efbda3805f4b0016cdf0ed566666
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 069b0d89f9a65a5c1a276578a42c5d240582cd8ae663aa7e86e7dd76a8f9884f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 77a15d22d5c1a1b14e153c7193509972dfd5e8c6ad000962150b656795257a2a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b9e1b1d848e72cbc0b838437e86bc1f01414f53707b9bf532a83be824d32536
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c125dd44a45599acc4b87ef3ce3b01289c8e6952db0b99e831d9468038d4426
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 51273657c9cb4fb68a471f0e713e2eb4f73f3646350605d4e8243b25a135450f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8fd72215e02eefab6fcd552b95f25f006b95d52ab71ca70954e1843f4eb8b1a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb12a93e180464920e81bd260fa77aa86e0c63cb4599bbe8666b3fa4319a49c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6927cf327dd6121ff376608add62956de5463df892cbafab011ef738db8da7b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1863cc5a1413ce607f32b87732478b4a16823c6b109d5cc0bfccd54aefe6a498
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 273bd98b293d5a8b75be108da0cd1601c764d182412ebf4e7c652952f6f8588c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8acb9f417e773863870f68f96f3891d822e2b70733be92acc6217ae9fda2067
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7bc53bcf1a3a381eedc92f306571e92ac5165a008bc5854be76d1d8f344b6b0d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66f1add3bb6ed9eb51b2a0bdb8cfcc76fdd60867d8e5309a82e8b4a607156c42
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 706559790494c50923d0ca4bb01455eb535c90d7503591bb3d23ac4dc81f49d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f45ffad07a576c71683b2b9d2a8734d30fd167c5b370d56ea571fcbe00578c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f3dedf54308a53d5997c66e466164d53c690d90fc1b2a9f784327627633737a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd38118991a6afcd68c6328f0f690c878dcdbdb0ff1aa0f0034ece7d9a2aab30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8221770758161186b91fdc987cace3a898ec2797749e0663e24ee833fa811671
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7332bc1696ecff45463d709ff2f4ba7b3d42cd40b278b0a390291e7ee1d0d9e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 430fa70be8acd7ece866edaf10b7d177964b41b0c09c7769944e274b7ae9f76f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a31559d3c41c7294608701c738b4884ec720fce8f65c0a7e382147763c64f77f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f963ca1a930e9a566014398a707581f8b33a334b6e7065cb37f0fb168b4e2d88
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c897187ca4d2d0799045424aae43ed3b9828f18b31ee9fd679416a9e3af76268
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d389cc4c037ff73257d2430e7f4467b3ac34d7975ac2d6d6bdbd89e1404cae90
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 984185a407c06ecae51d55b9aaf1215528226e00a6bd7329b9d8a342e9604a58
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed55e9432ee742fd07800cd371de42dd9d25364b3fc27eeb629a8770838bcde6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3dddc2ddf8ff8baadfa0592a856beb49adf0813d0e997ec47078bc8739a64af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b12245cb2e3118c100b0defc2b4a538b9b75dc49301aa2a471123b0084f17147
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd80e736a50558fe2dcc5efcb779d4947d45c89c7073b824bfa54a33f72cc9e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01ae205616b5b6ad29db2c42f72a64997a32be324a6a90694a45535b80efb59d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c5cebc46fb21fbf0012097fd60268ba2b6abdcfd4f3fa0368a142ddbc165b16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92f91a11dfc3fa33ab4d4f3514d47a59d67c5ef09423e03a9f09f75908de6f14
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54bd4db38c33a0e999c7cbf26a7c84df881647a9feac1059db17b9abbf5c2a6d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9956bfde3d4142eaa959ac6705bff8b4b994e75dc377678f2c06a1735cf136c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f94b0887fc3b8061770c5898a1478e514b9f47ff8d2ee95aadc8cc8e1e524b98
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 377d4651d92d284ea31e51a4898fbba9d289a6d95327396bc9b821b0bc6d8941
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4b864de562320dba8917f96e413cad11e8a5397f56e739b7a62123c2ab5b06c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da96c1418aa3f8fa597afa51d3cabcfb898c2abae0c662c9f35d8665cbfa85d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2fb55b396c6132467e426b793dceefcfe8fe36dc3a2d17477ed7f148653ed053
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9201f0041b68486dcfe4dd782991cf1df796a45d08126fbdb55e811cbe62ce6f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4aa69cc9d3ed54848f550c87e91f35f5e8adedf27579a2f14029027b8edbbc10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f76ad4e58d72ce9c13bb435c6cda06cf539ddc34f190688342a3fae4019908a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f1498bd0ad893a0e0316506d2312323c0cc6b743e28382b7f7ef9fe874ccea6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11760826d4953a1b69148c187929981c15e846ce5b17d9ffb595599340775878
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 377055de9bd0f81bcff0bb6bb1734318190962ce652a64840c698482d5a4aec3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 775b20147d8d887331cc3f7304570818c3854401828586c54a91e5ad10a3f312
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7830ccd2b75e6122402adf555fb679789d508ce5b7af88057c28628feaa51b26
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 02665ad9515a0c1fc75d9e0aff1c45e4920d52e3e8344d489358a7e48f5e9f5e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d94993ff14556a01dfc79bd5996fe99ca54c65e255583287f55075e3ba31c13d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 afdb4c871a5ab17ab93e17771b074b29d89099035bbc900d371d8d92163046e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92e7f0261e2cc011e5ea7617edb15f341213059aa8e4b80046bf0061509c1e2b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6fa578b78f3a86eabec8109929ca39534e7935c159a155218985fba42ac3e543
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc81f67cbeb7c317f7c4f27beb0dc4a332a738ae7f90bbd8a65be3bd9e126446
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b1128b3df8e0c7d443a58f85f46aaf92a63c5923a1b91df421050319ae13282
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bbe054a745b0e2098ddc694b7e1c5ced33ce79473c6fa24d2e411f953938d337
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b3eff2ec465eba920ba7d91b52129cdce2a287dc8442443f8344d1d3cdf8a481
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0d55c7351372ffb69189ae5d313abe7621b6cbd6c97f2624da1e8693cb0344d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f00d1c16d78820a2952ded4b6f2b58f50d472c451cfe4a36e086f7941ac2d343
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bbafa59fa87e4dfac875cc9f2de22586e280b2dcbcf2fa91a70cd24a22116f2c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 24f5e73f148000400766c1576d21a369452f32856c66aae4b01de7cf9ba231ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72178679a9bc6f2a8f7a20e0bd64d57f8a69bec93d0b6c84a7ece3a59aae9c61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 26d8a9bdc35e08d98b9f3a8c4a5c73ee428627d423ece3e55e572ff690da51f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b533196d3ca656640d8ded700b92034bf4715d18e548fa88e5c860ee5971cc91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ace94db12819adc1937a6f70b0bc768bbd096cd1708b4f8f7af12da51176a00
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ad0e5a5de8c5cac02123da15587539dc68651139015989d9ea04c26ddeacf62
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9152b6a92ef748c7bdb9f2798ca66f8dae3bd6b83aab57cb296a65d501507cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f4591f3a117b9adc1e02ef3a0cd36979ec48078f5ab8df94848d3fc19f892f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08cf75e7c8a1b8db5ad319a0f98e300668c2ac61e5283861b4deaee2394f1746
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 49bbf38ec597d2b54276523f6c361c00bc90ef6c0d2754472ca23ef4cc53247f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 00ea7b47e3191557d4f5e2610cb2a204f0712076fa27ff654e6a3fcaabc762ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 276309aea585cb7e2844ca26e49c93e86bb2f80ea5ac735edbadbf74bfdca5fd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 945daef9df3c6582af6ba260eae7338722f5d97d8803700499bcb6fb856bf50a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 810ec2d367300c5c11c3b035fa69ff942ea48feb645192fefeb624172f57e077
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86d5458fad3ecb57815a2b97022afdb8553d03cd1d74d63c45b7b1e6b7b5ec59
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f244570fffca1d11160c003d57ea94e7a10b57d772706ea3d260f1f97cd2bbaa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1a8acfda92a64939fb01943d34505cbd7fed9ae94280717b5b77301292840915
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9c41f2c28e838d90fc8b341c94f3ae767981d1c1cb80c798a74f492fc9e4e7c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56c921a057d96dc34d04471df51b33041f94f3dc6618fb8fd05f4fe2e5040227
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c85767f05313010b306755329e2077e86662d00b1f53855bd2cd7fb4bfdc1c5e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5adcfe51c5d7e2ce9ed2aa1b96ab416f350f1d6232f4a87ebb5f7a9db582eaea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e59fb0b35b6b133ad5e105196522818df4ca80543cf7350d5949d356fcbe4ca4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 74dd90e7bb8e777558a4181ab9d4914640edf4426c2dbe9b736a34b6b3bba160
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc23fb0d627d9002487dbf93a197acb76b27f5c84fbad2fe01dd197de029c606
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b1c41557d94b9922d9ace0586e06a9ea85f8b9601217f6414e13f8d8e8b0f9b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5013a0d6d05066d601f210b49c08d16d89a37aa21e4ea2d237218a033aa5449
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ae6bd1c607e2c33826302b83f130c0c220edbc44543c01c3ea3bc167c7433bbd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71e5876cbe8d5cdd408895f80e53acc784124c6eaec9f15a4745e08ed2e4487d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2aab383ddd188501ea49012895334fc55bc68b3b52f7a9c418a9b5da30f2530
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 764329a005d348ae735faecd800cdfc13eee419f285ce1629232e0163a21384f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 afd8b57cd1dbc5ff87eccda16b3c0bff7fe7024ad9e0f529037e2e63274e0832
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 253840485b93c5421a3bf6e174ee2fb7fa5cb3e800d22498ae42eac59e1c75cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71be30680d7baefe62e6577deb3467b26656fb7037531f23b8fffc828cf9150b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1f1048ed25da1c763ccf0ed745e2a8c03fe04860e9cd7ae873f3459c51a6508
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e3096750c46e9fb0d61d3b75b2cad6e2dc75175cae67e62b2c92505e432c48b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ea9b7f47f77a784badde39ddbfbe6816b7fb0aba9fcd44a36b4b92ca6040cdc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17db1eb74709c3ef7231d337bcc6be4393cf6d21e22518c64780a180898c4ed2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba853047061f8c3a6fbaa881d08576858fa6196d7d3083757465dd252579ba35
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e850e1455bc60dfb9f38c95bdaac264485ae7998d60bf7826228f1d7ee45f05b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3345a5ae5528fef9f2fcb7e7a0b5bf60c8c1a0f5c48823cc0d80d7241f802556
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f56e4ddef5ce9d90f1ec7e289c5dc4289519da4ba8fb73c6072c17d7fa8a6513
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a5f0472b1db7877172e318e98024220c3938533b5d6584b9e4896e5c52bca96b
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              notepade.exe

              • Path C:\Windows\wn32\notepade.exe
              • Size 489KB
              • SHA256 00d52575bc8059b245b38b17a7578609ef81d37b8bf24724b5d1e77a8ae08b17
              • MD5 SHA1 SHA512 SSDEEP

              notepade.exe

              • Path C:\Windows\wn32\notepade.exe
              • Size 540KB
              • SHA256 cb8e8c24ded4a9a805a96ad65b0c9c7c4d0854b7f2baec567c6deecb3b3a6082
              • MD5 SHA1 SHA512 SSDEEP

              memory/548-185-0x0000000000400000-0x0000000000458000-memory.dmp

              memory/548-181-0x0000000000400000-0x0000000000458000-memory.dmp

              memory/1452-125-0x0000000000400000-0x0000000000458000-memory.dmp

              memory/1452-149-0x0000000000400000-0x0000000000458000-memory.dmp

              memory/1452-4-0x0000000000400000-0x0000000000458000-memory.dmp

              memory/1452-6-0x0000000000400000-0x0000000000458000-memory.dmp

              memory/1452-5-0x0000000000400000-0x0000000000458000-memory.dmp

              memory/1452-10-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/1452-1-0x0000000000400000-0x0000000000458000-memory.dmp

              memory/1464-182-0x0000000000400000-0x00000000004A8000-memory.dmp

              memory/3924-3-0x0000000000400000-0x00000000004A8000-memory.dmp

              memory/3924-0-0x0000000000400000-0x00000000004A8000-memory.dmp

              memory/4604-14-0x0000000000600000-0x0000000000601000-memory.dmp

              memory/4604-15-0x00000000006C0000-0x00000000006C1000-memory.dmp

              memory/4604-75-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4604-187-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4860-86-0x0000000000400000-0x00000000004A8000-memory.dmp

              memory/4860-148-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4860-882-0x0000000024160000-0x00000000241C2000-memory.dmp