Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/02/2024, 10:17

General

  • Target
    9da4a44cef4416c6905f37b865525185.exe
  • Size 484KB
  • Sample240215-mbjasseb8v
  • SHA256 2bacbf9f90ebbbb8ed32bc85218b319d67cc237e5399d5f4d7d47e32c239a866
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • bobparkinson.myftp.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    system32

  • install_file

    explorer.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Out of range "9"

  • message_box_title

    Subscript

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3392
      • C:\Users\Admin\AppData\Local\Temp\9da4a44cef4416c6905f37b865525185.exe
        "C:\Users\Admin\AppData\Local\Temp\9da4a44cef4416c6905f37b865525185.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4396
        • C:\Users\Admin\AppData\Local\Temp\9da4a44cef4416c6905f37b865525185.exe
          C:\Users\Admin\AppData\Local\Temp\9da4a44cef4416c6905f37b865525185.exe
          3⤵
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2468
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:1636
            • C:\Users\Admin\AppData\Roaming\system32\explorer.exe
              "C:\Users\Admin\AppData\Roaming\system32\explorer.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:2504
              • C:\Users\Admin\AppData\Roaming\system32\explorer.exe
                C:\Users\Admin\AppData\Roaming\system32\explorer.exe
                6⤵
                • Executes dropped EXE
                PID:1260
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 540
                  7⤵
                  • Program crash
                  PID:4352
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1260 -ip 1260
      1⤵
        PID:2364

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 abcb3cacd716321183e161ad94d94c6955e2107547d5897b77949890fd364564
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 d9ff36026df51a9e344c9c9363ee823cb142ccdf100418aaad3408bd01b991b8
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 472b6d35c9a9d5ddb9d394b561b5ccc575ad61ff36c8f3e3943cb5ec77513479
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9adf033e995b8a1b50ba98b126afd0dacdd88f458ba34b4f891abb7fd12ab522
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f65bb3e5e00318f19336a625babe53e77737d317fbe210aedb97c30097a3fec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 364c63a1029cfac4480c017954eb2c10edbad18ceead4453c72088a06cd22c2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0ec701bd55bf5f291457f475d8fcd72991082e5067e6511cfce72ba87f60e56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 483d54afc22f6309ac10976aa7a1c07d34cf2cbb66724749176fe70965fa5bb6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d78a08aea2ab74d007b29d32811d00ae768e1310202ca1f1ca5f4e66eefd464
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d170fd75cf0d25adf6ec5dde068107493a3564262cd5261d274f3c6c7c5ac3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 326ade20113967995a2170c00314055bb5f1d13e4141f7771272422ae0f19add
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24f1fc65374f0d8b2543d94f32543c3454693ede594f20e2e4f979f6d28ae541
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f656602c18c781ff39d2afe8eba86c53f3dac6008d4a663c31ee0bd774306ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f49609f3568a123975e64eb1f98e732b6845db68e3cbc3c2ab4dcca11263e4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ceea13918421cf43815acf6b6573e5201ee9240fbbfecb2a616a27783b74806b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a7bf78ec10c027a933b1f9b71fdb024d615a88a9f357ee0b38ac6872ea41fce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6272539341a922a65ec0cf9a04bef4efcaa7e68f59cd19d4ea8a721de259ccf9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96519dae2c1d474a10b98575089ecfca6d8251b9a3f4d073083e1074b370e99a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0da3561c53acbe10b9e0a103e3c361427f611933dd212cceb3b6cf8a609dd9ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 025cff42822ca4632d2a7e9adbd28443811a64358b7b1873bb73da75e2b17195
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 056cde3a25a31378967d69ef1204b30022367a9205226f719d2dae38c69068e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e18852957fcba8343d3810b20ae2b8d3a82ee965a575e847b3a07c9e2dd3266
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22cae266df148acf46127a48cb4f2b0d32663a69f2b80ff5e1cab117712f04bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 802cd1916a70d287979e99c1395f9a9cf52c4ee149cf7ca6b8d6f904e36c405f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73ae2fbf7d403b2c2c15739305bb85a4c7c6a8e90d075963719b3f28c441787e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d790118b7000ec07ea99adc420ce9b567a6f2f44ce7c3e58b1390c4a998ab697
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e8cd93e0a9abbdcdab1cb2972fe75862e5a353d9e45975bd594c0a9da06d574
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39ee357d0492cbd5536d8cf58cd3dc8026e77d3c2877cc819931d51c0500c431
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10995777240603977aef24147f65ab87cee6e6b71b63ab20b738177df53b2592
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfb7ad783c4220e914065820b09fd9cbc59d02cab728c7cdba9586ab05868938
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77b94695efd871a2d66bfb4875b7481151271aad5d4abd475953156cfb59f764
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8aaf472a9292bcb4e85c30f30809bc321d53224236412e36f697500089a30143
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 539dce1d61c49e6b771e83b1668679f68f5f4e9675a1bbf46621b88ed6e53403
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7f45d79671d9f97d9959ce70649f349facb9b03700df38c71e76e529b79e4f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e615c8324b2e42d6a413e0bdf92f20cab24f3bd20329ffa9c6394eef8c3abe8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1561d01e34b239af73f6f7d328fe171d286f4414be266cc2040efd96fedb4abb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 692998464a0a43de3add0c7473b68a03f27573a8aeee259dbdecdfe2cb58f729
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe722f0799c3cd6e4c48df8ddd9b7fc95988ea37ae82f7d209b3949173c9b89a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 631e0bf4f7dafa0c318920ce1dd3681f89c0ff098d36aee55e44251c40de4120
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 917eaa7992f4d74b449f09ee265ef3c7112c3d4ab4f2db09c71f48b7d9e9c637
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b4c0796a2e60a1127d149498e9aa08f03b4ef602157ae1a9be4ae94daf54a02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4713d8eb7f1c00a8289220d70bb7011c6ca7e9524992c795dcab2a7f59dd3267
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b705be1d6b8b621c7cfb9c89f1776b7c094f93af495b36f400bd0c75359f9bdf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53b7da3af589ba4c5cafa9870ea2f6feed8dac9d2f56e274ecd296a6a7996226
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb17fb6d7203ed81f45ccdd0b63f16a6e9c9dd68ab8895cbd89285a8e9cfab2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f11155bee98fccd797cd11d28ff377cc2075a48d9e57b0d9f40b30d2292f59e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ca0ad15ffe03ad3ed48839c2444e73d9af098b6d366e38de703a54552d776b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 661110f88de8e8a73207b99d9086b962df732f8ae3c40d06ce748534bdc0247b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1baadeb06887b02efed29b5d9f3c902478b3641f8f2795d8e3e66ae98bb2928b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64325ce5e3c30c261d3f5a6e597d662b98c5fc2b5395e1b95ebca6dbfff993d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2efa300ced997733a1160e8032764017b93f99030ec75941ebeb7533441e94f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b1897f288169cf76ff85dec02d814ff0478140a1052822d41aec3acbf5a14ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a51a3e3bd44df9013c8529ba9fbd321ba119e409f604326917f8e1356f82d4f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae9753c17e5d7e65e5fff2114aec80ea5ee8296e93914398fe2cad596b8e67f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6282ff221345929aba526ef03e87e6f929c8d59b901bdfd06fc132de7174fdeb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ff0fc17300b96a963cff7fe8f395fd51cc53da8414f8ddc493ba0c48e1a329d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cec1522d8bb1eaf329426ff888094fa2f24335cc6e94c9ce3e679f94689171a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef9c61fc7194208689af982270ca92396e74fd2488f8eca71c77a92e8544efc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68f0a69ffac84de4b9dd4d1ca39e942569340d7acdefdfab4d7e2d54d24c59a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 147cfa7f77aa7bda77ee9dc1800580da1811c32ea17af6e0a6a066f88660ed28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ca10c7a0f68e27d92c020a2afb727544d734ba3bebe2ee65223a47bfbec9b6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3598e5f49da47210f9a633f580aa2edd55a1247d202193894aabf006be6ad182
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7a3d4c6a6780257c40f0295d5a7ac1cfd520668abfaf07871db83a9560dbec3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0e0d577f3944bd58d1e5c1963e5f86b58b0529f92d0e57b7da4da818bc39808
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5121aa59fbcccc3785f9a68f89bc07aaec19e8e1ecf1afd71c5bdd811ef9d815
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15edd5cca92500cee519766a8b65e541c637ac8726441b978e452e90d4e82ec5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c3555d2bb84983b39c1b7fec325c17d1fa58c60bd0e433572f39f198be9f8e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f435b44e5b73bfb04aa802aaffd92cabb002f339a31767f13614a605d5022970
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eca2ea994f5e9006c718ffb5290331fd8a3c7202061f9820f5652dadb5dccaf2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 197a2fd4a1e9a7bcafa4cee7e664169e3d7a481490fa2bfcb5c69f4059b9faf1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebf39f990f797a969e3c2fcbc72d336eb05687db869d9afcd9f8d89d1cacb7d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71f750fb5b6014bdf33559bb4959baa35c416d28ff11326e7c1f3f31454c610e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e19215fc3e3c6fd08eabb59206ee6c6ef41f2c46f4fcafb06664ca126560244
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73f8de5f8591e27aa2c4d177d59dd39c7a53bbb43121658f99f72fb2478f51a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06ca86dc9fc7506174888047592f9366191df7f14a987227003444721da4ac2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 684125c754c93bb2480a846fcf6a07954d0acffc66dd03e798a37978a8b3b837
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea40921c2f40b0af2f64479109335f00f1e77bfa0fa25c2107e773e55d329ed0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c336c35326064b53c01fbd1540a50f7e6691db44f6aaf22be7b80f578d62bfcc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ecf29489848d225cbb11db2ed6b953b1fb3b63ae4a7c0ddeb5011349202607a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e906bf0099d048cb230da66bbe5d1e9fa85c6a5ec3dd2794d2a20780cc92c647
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ce1552155db09d6b3e1de3948820bd90c4da8998f2f422003cc5716e534d5e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f01abb44fee8b25e5f4408f2d02ad058b27fe3d4f61b17964312515c1d4c17d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c59ccf94f6a3072efc0c939215d926857745b24f3655b6959ea73497f15fa347
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 019dbf6370b56405d02597e78080b665a7d1ee95bbbed6bafeb20207198eb95b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90f495701eae5b9a58840fdc8da443ff9106d59739d2d53efea7748406dbf1c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 790562ec15a9a817886c3ed5d5814f93547c5d35bf2ea0f67bdfe0eff68d8514
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ff67a6f541fc88648e9ebca708dcc5380d51a30e5aef5013a37a6de9a60a2aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e021ea89e5d3909b039d4a1ae52b23cec8811d6153ab9c2747697066ccd913f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67843736f02b1ff8de4256b7307fe8f451dffac0b306ffdfbc12b6ecae761790
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e34d6025c654b1f4683c1ab407e2fa0419a20b58d575abc37ebe71ed3bad015
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1476825a8328beb6a9a72842285e52e051bfd211daf27d9a714952674994b9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 586a757deb95df2dff360a5497854e327a113924cdf2f052d9e973580878da60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a531d8ff932bb76b47278f9a0c72b88e5b3ccbc48c774ff8a6cd0609c2599f05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 607f0f2f9604ecf2659d110cd79c6aa66f95056fd1c253eb9d2bedbf172fb849
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31dde9db90281e942f87bd476433af5b1b23f065a01319a95d9bc703d03ddde0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e5c23f994da64a78dcea73756d839eefecc0cd2711ce3a07508f79aeb2d68f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc4086a326faa1c716f3acb93036c7dc783cf06dfe99207295f8d3e67eeea152
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8062768d587219672e34ace32cd8f595aab59684bacfacf0ac12e256700d7c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2544ec76b5b49f66690eb7b3aeed18f3f7af7e6c9c28b113380404a10ea2608
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e541c570e54a170d5114505cfd6b338eef57c89f522b34d8903745fd79e5afe1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab07017bdc72e0d54ac5c3ec2f8d96093652f21675caadfaaadadede33b3d41f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4f4225ed1020832a6fb7734cdbc84340d9475f67c6cf9c7e8024bf33dfb0b5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edb5dbaaa11d6abc787ba4165878e1ef15452aeb0f2ae5bb5fd13ba848656fb0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0cad5ac65aaf8d8be7ce4a779ea7bd303f2c98d13c885181a5ef28cdd0351c65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff1ac6114142fe95eed3f3190624be596882e8e83680c6b4fae0c7cf129712ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75aa1e1004099cb254c6a9381a76af29e6037aed903b1c955e9b9a92d148e6a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 734d4aeb7586c28bfb435b9eadac99c56bf8bbb74c1ed96bd263779aea673390
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e0d9aea9581b00e12f6381fb7be5dc3f72ada6f3339b5c215d647e9ad841e44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d236527d691794a54424d2c54880fe4c4ed97a093de6e06a380ba43fc6900fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0daa0518b9e067a4dc6e6a41a6e54ecf68d0bc556f5ab16861906b30d437ccd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c44ceb0920d1c11f258755c3e23576d5f02de83ea7a316b466afb72ffa24c20f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 304263be905d2157a972bdd923b3420c88ab6429bfb5dd67343943bacd2fd345
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95f40af76bbabdbad5590a69d3c322edb8744e43e92ce8157c04c74d0d55e304
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b25900f1b7802bd15a907bf8cdd2af2fd8594615da33dea6132b42cfa3decf1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a2289a42046072637f1a74f74e15a099842b4e2c871a3076e603e76126e74cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62b6bd12a1892d77c4b36562ba86f53161c5306e0d38210b7520cd59028428db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e1119c3a5e9a489e823fd730d7cade40536a295a174a8dc17623744235dd751
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcfb443b2461c1104b85c044faaab38de7f06cd6a5f52e6c79306283ed1ed2cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 902cc08a628b01326b1f36850409f6ed030381a4802810dc96eafea67cfc23dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 936a4ff5d748a6b465f13eb98da47252cb198cf06c0853f861538d4591c192c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c280fc2aa4adab472c52e1742e3aa702c961ad7968705d5cf1f9af19b7e92083
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3cda9bfcb06b9d7147f0867d8da906ac36122ffb05ab333538610947adf10e3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3823d012abf116fa30010be72b3256255c75c8156355fc19301d380938acffa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a9fe95d4e0b50d91b469ea3294314ec1194a71e974b1349d4ba472063209c6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24846b060f6107701b0ccde31a69722d1e2e0c2df694275fd2b64eefaa66307f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a5d3f2b91ffecbfd6726e2260617b573a59d16bc339e80f68d1d861df595847
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9dee12076a4f1fd6ae3fd9421e5917b2596ad94c3b7042827a8d9042363c1082
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aabafb4d733d73d5a0fb106ff7306dcd419ea9eb674ad62b23ca665950b658ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b529380f56a8a650bc2990149415c89dd7e8324797bbeae9019db420868e6e7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0febbb95e7eb70472e55850f25c68b4062a23e93d296bd1dfe380c389a452a22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 409429a28f89210a712bcee5a9e194078b04ed9793513c6467dba772cf22f5b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3eeecb788f1b5454de3e8d35a623823c9fcc34c199f404ed602d489da95a3806
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0909125ff6a1743c510a0422fcc7b47ef94fb2e125f79c37278358d622ed784b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e3d2840d0196ba9d28c906c4d1b5e2b95dc7e2f07342378133c01b95d843b90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c85633536e0d6d68bff0923de5df6ef9b3d422203be9a5c3224dcf26b120a9c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2bae4b673642be252ca9cdd83e0bab3f60a8315e5558e507cc7722cd576d032
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed94e695edae2359aa83d6c9dea55bb147d75204494bae03f3316edbfd719542
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d85dc13d189c08beb623abfdad749316040f055ae02c7495054b0c460b8dca09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aec28b81badb1f35187298d8eec949708f7f3b09e995a8ca1c22ad9ab768e835
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0c2ef797d9b28ee9bf155d059716a95fe36dce7fae24007f4148938e227c9dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19d6aa59fc3fb028e4cf55468ba2e2219e3f80e24e0f82529f380e8409373309
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            explorer.exe

            • Path C:\Users\Admin\AppData\Roaming\system32\explorer.exe
            • Size 484KB
            • SHA256 2bacbf9f90ebbbb8ed32bc85218b319d67cc237e5399d5f4d7d47e32c239a866
            • MD5 SHA1 SHA512 SSDEEP

            memory/1260-109-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1636-14-0x0000000000C40000-0x0000000000C41000-memory.dmp

            memory/1636-1035-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1636-76-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1636-15-0x0000000000D00000-0x0000000000D01000-memory.dmp

            memory/2468-4-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2468-10-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2468-6-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2468-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2468-5-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2468-70-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2468-78-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2504-1261-0x0000000000400000-0x0000000000436000-memory.dmp

            memory/4396-0-0x0000000000400000-0x0000000000436000-memory.dmp

            memory/4396-128-0x0000000000400000-0x0000000000436000-memory.dmp