Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/03/2024, 01:58

General

  • Target
    b00905e4a6f2b0f184b3b762c7ba3dc5.exe
  • Size 534KB
  • Sample240301-cd5lpsab7t
  • SHA256 a89f95715e64297820353a3669ace97c390ae8d14e6a65a84363b1e1998b08e2
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • ratisgreat.no-ip.biz:999

Mutex
  • ***MUasdfasdEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    win32

  • install_file

    sdfsdfasdf.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b00905e4a6f2b0f184b3b762c7ba3dc5.exe
    "C:\Users\Admin\AppData\Local\Temp\b00905e4a6f2b0f184b3b762c7ba3dc5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Users\Admin\AppData\Local\Temp\b00905e4a6f2b0f184b3b762c7ba3dc5.exe
      C:\Users\Admin\AppData\Local\Temp\b00905e4a6f2b0f184b3b762c7ba3dc5.exe
      2⤵
      • Adds policy Run key to start application
      • Modifies Installed Components in the registry
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:180
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:2256
        • C:\Users\Admin\AppData\Local\Temp\b00905e4a6f2b0f184b3b762c7ba3dc5.exe
          "C:\Users\Admin\AppData\Local\Temp\b00905e4a6f2b0f184b3b762c7ba3dc5.exe"
          3⤵
          • Checks computer location settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:752
          • C:\Windows\win32\sdfsdfasdf.exe
            "C:\Windows\win32\sdfsdfasdf.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            PID:3156
            • C:\Windows\win32\sdfsdfasdf.exe
              C:\Windows\win32\sdfsdfasdf.exe
              5⤵
              • Executes dropped EXE
              PID:1864
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 540
                6⤵
                • Program crash
                PID:3336
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1864 -ip 1864
      1⤵
        PID:4552

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 5a416f2e19204e645c15157597c5d4ccc2c0d630bfb86eea693af7fb5b78a872
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 31586ef47336ac81ca3e7a15329b4a8b14fc75d44cc13fabee3290bb0100251f
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0322cd620ee512581bca4d5329b6319d9c9646df76ca0734d21306b517c2d67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c901687f1e896d818c0c2db06c9e4a2f1bed555baede24785bb073cda926bc61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fda8d3d95135ac3719f85d6eb2947cdba5edf63472da19a4533ff02efd1102a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64acafd67458fb39f7fdab3d8db57bb40e2f4dd58e85686fda7fe3320db0d162
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94b54460a59f716f0ac64e583389d7439e8e0433fcc81737e049792da1856471
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22d89757827b229b2043c28a47e3df2d61893097829bf821668b4f861926fc86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a969af196eb35ca5b1a6bed9f3265219243a3264d0af5d886d89d34a3f9d654
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 234fa2c68e89726a0048045e034bf0f88f71ecddee71949226d0aefaaa0baa49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eefd5788c662d0c79f43d88e937fe5fcb4f7802c45a9ebd8e2f900cb5713cf68
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa2a93f3ddf67fb89d14f3999c097e1a8fe8dfd520f66302873fa3aa17b8c015
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6822da1a00b486091cab1e4f0c68df3e6a83d5da13be33f68fcbdac662da7c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4089331ca0d928a66d51eb597e3a5e021971ebaed77935369415d1df580c9765
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11045a50b6926c70255fac31dae9e24bb040598eb1da376655546771157cfacb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2ae5bd355ff283e95ba8482b18f0e0a9fe6dd140763225241b001b201eedbfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bab6fa4b3d132c61faafd5688fbc1f8fc3b87bb4afa09c7fe471bf56dba60350
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 531ff2924a54f70eb7d6470936b7cca5b14cfc84cbd8343e5cb61dd2c6c343c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c43fe112490862fa14e9334f81b5f26026844529e8b583c798e753899b8c7084
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea6ce5102146447f31cffd51f8209cc1f5dc36c2506a39c0942fa43def845297
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2acb5f9ac2eece1172902767bb81a8c7bce88d4aaa9f9b16664f754c85f2de17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e53e5b9f1c57b0cc38e7ab3e37550e614ecc6898391ba277e4b2eefa1304e0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54140ab99b8aeb035f0887693313516cc2241ee1ea70af943eb106be6f505b05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ef03e5d56efecc5ae2d0311d8332c0382e5b4f02cf8e26ab04ee7d46d2de364
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94b13fd6c479090103a878d18703891d8ae55636980cbf9ee2ec565f35d03f44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7407fef1542f35b6ae1c541bbb82198d8dec3cda3f43eb4177caa852f1f9594a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af5002ee612005ae90812b58a98afbeaf8836e43d3b37e4d2a0a63f50a12d514
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a9ab1abcc27b21e8766e7e5062eba1d4fb362d7b2a71a10229346604c32a8d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21b7a567c9fc6dcfccb7df8281f69755cc6ad463e54d08a63dc622c8f15bb301
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c1ccab48d9ce9f8a75efd630c0b579e1a3a9e5b5714183856e303346bf8bfc6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb75ff20e91325dd0bbb6068da833c9212bc1c7bcf6ce90113106bb93d63cc8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0882e1811dc83175b456cb0641b2f6137dd37f7ce1908f10ed129f9dc094e5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47dc859bdd39a4a588a818e1818a10165c0e3f6717fa329ed6def1536340a3d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb5e25ccbb3cff9235bad3e4f75af007b53469aea718be652fb749879ad6f457
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2052b8222a4120f817c1a11dc28c56c7df1e32c0e4468d05e35a0a1c9e95f768
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf28a42d3574524f7d84b5e873d8e9abb07b1fb06b0a74186288ee7221ea5180
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7e721fd8ae5c4e1f98708254b08603a86f13cfea002f305ac5aed0675ea8154
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73601385e4350b539c3c1f28715dc2ace0d1bd3d14b0943b183670ec903ce6c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9e6c447b551fd6bc21265446e68794ebb52254ddf85ceca259f43c5d85b24fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0cbbcea46ee303a7c3914013e0dcd8e23763f35fbf290550efd838b821c50c80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2dcf376069c647cfa31b8005cec8ff3ac2a21d64d24ca059140892c52cf70a0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f945d03849b25e435c5d13f84a7d73cca65d9fc4859357e2aca229ad5e72ff8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 231c03071e8182abe41a78a0dc78943bed63091f947127cae73fc0ea10305213
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e82ef0d483d94665bf32cad62ee413c88f126aad5031d0135268505a3b5462ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98c2675c46aeed69b549f1e2ce4043a641c72aeac3b57d1b2d83d9a2232f7192
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf2a84964d0a4a94dbdc94686936a9dbb7d784c7cf7250bdad25f7e9fd2fa1af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9843132b890ce0a6209845aa2f26ca7515fb1813b86dbe58b0c060d7baae489
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b46735157a408b2ca8d67c07efa31d741a52c837670e8213c4b7fa7c2dd9f3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bda30ba51f0113580fb422f5813e5adbd270c045ffa5fa829fbd629ab464d77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebc88e79173505849b491886d924162a035f888823bbb22ac6f1de35ffa8ac83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b629d32d6fc7c42d1bf3cd0624f1a3b93fadb6db2256268e172b3a9c23dd3ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b890da2e52fe06e1ceb3f6fe39b76e48b2099f4289d684eb3ca62c5aa2a63893
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1474b7f5f0101a32627df5a38940f714df6738d4a59a4f0d52ebdb2ce475aec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94f2ed8705b6fad874a262983ee705dce19b78f82ef3de23ad18c41c3344f28f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e606f2b70930a123ffb5e0d9e6a91e9b70f32aea5a55154e31afa6e173a2f93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44fbec97c90d8fbdc85c544f220f1ec0cd9257f8319dde4d4b24c30ae2691cfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3a3a1543e2f440f66de694f5ee47c362951b54e6a7ff6db9b6af3cc55d7fc91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6db58ca4cc6b81d1a31a6ad8d81fc5e8a80f5bcc37ffe0425ce3016ca846de3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c81e946aa621dd5cbef4589a48e353318eeaa1acc9a79787dc3628c782f2445b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44109789c802ffee335719bd360e48c6c09230b215d476e0ee59fa259672d576
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 812781d95fc3e2986f4b04cf6807d983fb1c41178a58ada017efa8a5e7438a1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 644c3e0afa180958a49c2f052cef4480d3f714964eb09deb8fb018b3cc0a1ec8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1168828aae84b1b91f7714226e08a49a06d091c3fd148d23b6ce6cf79bb0b5d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd523a60494019f2fe3f4e14668738a9eec2f067392c1a70c133589cd47b282f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9ab88a1ce11749f9c6838a7669760f5a1b8e4ea1431d0138a869b392f21ae5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26e309c5a6a02039916b3e3de2f814e95788172a70925a3110db302e41c35f32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a99ad2b1391eb565326f22942def0f46c4c905ed29c3c274b371679bc7aa3a87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 831ff1308383e07412c6f463f6f44736bc39b9205dba4add4ab1445afcd95604
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6e707433949bbca838df3fec01a1f61082dfc2890eaf03ebc0061850a8f2c23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0c15fef985b2b2bbd16f94f8cb5e47347d9189af117dbb821d5770cbcc09b80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6e42264e1cb0b0edea9ca91a9b15ccd5ac915064acd35cfe459ed2380b02ebf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c72ec27bdb70e2d5d2201b8d3d40465a80fcf8857602442cc896b6dd82c6fc07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab4c813be836080d675a7ac64e34a5413a4cf32f46b0fd6194b2c998b9a4c825
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d84c60ef69bbbed8951b9fd6f140b700b799dd8e7692bc6c97c430404342db6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7cac7e4453a2013da145ff7b0ee768c51e6e3dd008e7f4452268138b3a80a96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d9a9a664f4cf6d734166d7dde8a2d117746a15d5ba9985a43c0a42ed24d5b27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e03f868b84355fbd001942c4404cd36297e9e25089da597e7a9b911602a2096
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dfce1be745561de054275a114884b5778a6dbc988a297c7b2a24babfb9e67b77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6ffd0608b95b84dfba4846033707436af504a4921d3ecb733c97e0f55c02b70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b174a162eefe9241b2784eb5e8a8bd4a470661253c6a54feff9df3f5bf98ab6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a78a435d6a51eeff99b7eb3c530efae0fc89e1560f3d72bbb7feebe5948d7a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 324869296631f98bad5e49679e403638a3088d6a4fb1461f8850999acd7f876b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f5024ad7b7b6c5ae0534f7d7f51b5259441c1fc62494d5ab4c0771119f9b115
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0677f57e3186d0a1faa3ce58fe94970843e1536b51f1949a99831a873af7c04e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9b268217637bbee0a10b88e6702c4d201a3251ef084d1dc1713e340006d9340
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa865bedcde1190e015ad343cddded4f951212633a4fc692034e657376a146e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 475652c2695056294b09bb09561225dffa54fbc7173f141e2959e46e28124b2e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c0f52e7f6532f302a27e094a74fb884ffd04898c37977a415b7ae970ae46f37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d20f56cd3b9782afd0a818380fdcd4c9ecd53ac5b7481a698b42b454a4052c55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f909415b574e55306eb42b27cb7c495f529956b5f5ebb8407f06c8d1c249be33
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc068f0e696900cf9362341dc1a1cc436934996b8d399ba7d14a9a8e9bd8a020
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9e30b4ca99c5e9f45bdbe3295e26b8bc5cf127606e5f4a24955a7cf35cd5972
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acb5de6ff39fd62154d7ee3aebf4a007ab4b7d18dc0b82c0f5013d622bd5e956
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0bc2e03f7158fc6c259224596497e80ccc7939f77104c145076f43c79964f62d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c86458858374d6470c6072bba5a3156093bfa5d4e4e851b6cc962a4013fe95b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 227a2b7c27d3ab861febcc0bf429ea89348ca60c8c50d4d0ccd6556a1c826bcc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f395fdeaf14c9dc702bcdebb221c0361d3948570fa88ed0e4eb0d2fb066999d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a77977fb7804dee57772db582c373a4e2ad17d85cdf2ceee2863050d2916fbee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3eda0610cc853c6d789164d5fca593916d355bd1947c66d9b23ed94f3b6830b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9231f4296debdccdc21ee85a63bc39975e7f61423ebfaf25db9061cd8d9ea5a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a05cd417f44917b204f759093a2d6d964f8c60c44c48d2444edcf0a24b79080e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d48cc60511a87f12dd91db1ff84a2ecea80d4f07c40f1139ef8d1ad4b0c10331
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4c3a015900fc0da5c9b24bdfd3ef1f765dcc8abe26f8b2af05bf5538456ba0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9fa16fb47aedec1638891cb66fd015dfe07ba0f1440de24d4d084daf4547bc0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1cf68076b323f5841b70022165acd89fdf51762c31bcf18fefb29f362987bae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 654eb0d4c225d0dfe94d8f6fc32787dfe1616009ba6ad0bf42c7e6bba8b54f03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0dccd4a9bbafc527ef4aa148b0cc2a8b60a8757e06075297d5d1bada09ea9c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee688ced3a91c55c9b0b7d1b330aebf552ef57c74c0233e99a4f2ad090fedd49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7e912b82eeee7b784b594da3cd6ee31c496904c541e50826b3096948d0c9277
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3033894d585fd95543574c2c0c00bed12f5c2290bdea90e3feeb2278b08b923e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3b9ecc7920d2d3a424d507acc18aa35ce16251b786ff2d5465586eafaca6ea6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4ef175b4a9c0971412936787c15e07573fca02e1033dda4e74c3a7aacce503a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b56b81dbd78cd43a6e55d3865c5d27377009fe1708f50b233d532c39665221f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b3e605f8bd1d2d22aaf831c2f29fb6fadeefb389b304ef8ec8800ebb0d36fd2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0f1b6dd355f15d8d23b90733e0d9612a29bf84537088122e3bf37c1ba4d613a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d9ffabdb68555e6c01a0943d1af886f86804755420333d65a2091448ae5831d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a9324b0d8d7978077e595c0023bb0aad6c38dbdc725e83a618a1dc1114529ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06348d7cafe2e0260223c6bc55f6786301f5c3d2cac0c6774ed446c37dcee7c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e569423bc3ff6559afb7988b2cd2253c48c027aa0726adf627c0ecc2b3e2b9c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5faf435d26577136eeb38271a7008440dbe1bbfb6986f9e1e576eacd9c482938
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9d5d33a4cb7990c8cb6c70eae2666c157c4d80059c55c3a0b7dfe2e6a9b947c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 458290d6f48ee84bdb203cc89c1b327942aea178f09d393628c3e50ccfeb7b7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 283700a917238b7d4aa43f29cd07108723983650078a0e3dffa7f877f1e5c222
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b5ccae73d43be4a4bc24fde589de340762ceb098a6f46eaa856b6840fb16dbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ac51c90c4a133a8af280a3e86659387b786968ae3f15b0d877aaca2723236bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4235156402e681808479408d301215e404d5bcfe0be0487bf29cdaa9601060c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ca25484ec46c4fbd7f48051020e3a191b863453e80959317794b45077afe3ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c0524177d21ace476c64442bf9e1ec2ede3b09a05b509bf51d04678366feed2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 040ac0818a6a8c872e90e5f8800a733d86008cc050e303bb53eeb5953eb6a89a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85f1030417128ef0971a09df3400881d505de6f6de14c635ad5f99b2e461a6e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c8eb938f4e9ed04e91141a8b960ef2503e9573e4e18458dc7321536c848071c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbc2c06b9dd1bba9bafcb1a2b52b21b7add20f697774d13d54a058cce8514a7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d2b05bf20d29103271add77382673c8a41b3b757580bc1f481fae36f85c07b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a46f2fe42039d1ea77cb4c61b0964683bb065892ae88bd83623ecb9bc3b483f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de42c90a488723fa822309ea1ea82ce928fde9bd272fb978e2e27a5f3852e7e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e92ba566ff55e26598fce2bd9ffa10efac70c28657289da34195f7d2f47448c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f392daf3d38c57c38d64e7d55c82068206f013deeff90f865a63deca769042c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bba79460ac8154d4b41cdf86fa653b41db8bab23623641db0561570de21ad795
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 662afdc37ab73069b93c1951b2cbbf798b2addeaaefdca80946e18fab3dac15d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa45b458c3a964e8faf14d02819c765fc45c5e56670f0dcff80694b54fc57afd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04422f5dfc1d28d8f754da4a793bc67922182a2a4f8647e920c134234512a615
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            sdfsdfasdf.exe

            • Path C:\Windows\win32\sdfsdfasdf.exe
            • Size 534KB
            • SHA256 a89f95715e64297820353a3669ace97c390ae8d14e6a65a84363b1e1998b08e2
            • MD5 SHA1 SHA512 SSDEEP

            memory/180-69-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/180-76-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/180-2-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/180-9-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/180-3-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/180-5-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/180-4-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/752-1218-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/752-77-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/752-14-0x00000000005A0000-0x00000000005A1000-memory.dmp

            memory/752-13-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/1864-108-0x0000000000400000-0x0000000000450000-memory.dmp