Analysis

  • max time kernel
    153s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/03/2024, 01:04

General

  • Target
    c2111180adbb1816c083e3d245c7f5c1.exe
  • Size 550KB
  • Sample240312-bffvpabe3s
  • SHA256 cde354f099e1a042ec7cb8f40bc672234c4c0cee8d052fed3915ec4c8931d61a
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • denemeolur1.no-ip.org:81

Mutex
  • asdqwe54

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    drivers

  • install_file

    servces.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    driv

  • regkey_hklm

    driv

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3240
      • C:\Users\Admin\AppData\Local\Temp\c2111180adbb1816c083e3d245c7f5c1.exe
        "C:\Users\Admin\AppData\Local\Temp\c2111180adbb1816c083e3d245c7f5c1.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1084
        • C:\Users\Admin\AppData\Local\Temp\c2111180adbb1816c083e3d245c7f5c1.exe
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1760
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            PID:1048
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:2448
            • C:\Users\Admin\AppData\Local\Temp\c2111180adbb1816c083e3d245c7f5c1.exe
              "C:\Users\Admin\AppData\Local\Temp\c2111180adbb1816c083e3d245c7f5c1.exe"
              4⤵
              • Checks computer location settings
              • Drops file in Windows directory
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:5108
              • C:\Windows\drivers\servces.exe
                "C:\Windows\drivers\servces.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • Suspicious use of SetWindowsHookEx
                PID:1608
                • C:\Windows\drivers\servces.exe
                  6⤵
                  • Executes dropped EXE
                  PID:3188
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 540
                    7⤵
                    • Program crash
                    PID:4768
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3188 -ip 3188
        1⤵
          PID:1428
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:4868

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                UuU.uUu

                • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
                • Size 8B
                • SHA256 e4a6d955c1c40c255badc409f4f967ba0da63bd087917634f2f6ba2b27323f98
                • MD5 SHA1 SHA512

                XX--XX--XX.txt

                • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
                • Size 229KB
                • SHA256 ece09e4ac4c8a2f0561d079ef7eb6d0fc5468e2ef1b1b69e4d493b204c09a8f7
                • MD5 SHA1 SHA512 SSDEEP

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e871e0a937e60a280acaa93ea597ef20183dfa1594c05ceb9b7f871037669224
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c380a02e0eebc1be994599d165a8d373ed68923cf62c1e88d2b722bf78a64408
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1b89212f15d4f043a95352c5d388373918fc18d88f4695ba986bfcf44fb36a69
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1f8d2df587a335ffcebb39cab3baf40529d0f313e6da8f5b84753fe0d70ef90b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 31421c3ea0b1c2b70907b5dd2dc5e67b387e900608e1ff4edf0bf6efa279b61e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7489f9d3fb8b7e0fbbccffdcaa22f2d34de6b2d8a39d41fd852f6d357c3c2a85
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 822deabd4f7a0cb95c4b39e05a907739a66987e413e3888d8b6836bfc24b09db
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b04d0da9299e5f2d4d50ef0fe67e4f28783a8a0e1c4215b65f71333136ab319f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8b2c783dfa4c193e6cdff0f2405fb5726aab0f231f55cd1645840fa602ad5617
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 436f0ab3d51cf15a91564412e7109714ae59e17730ef43b374cbaf21c924c182
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 48ef9352ebe89a07b5fbdf310faaff20346927d7f38fc0a01c6dc07b5b15c7ba
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 3f97ebe9e06d5f868b5082dbeab9faad22da99c3978efa5e24fa559dbdd1800d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 306c3313b15b2d1a0be30e651700b546c7abbad8f43ae25fe7766b2184d988ef
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c382873e1383fdef7ea1cbf69950c8629f6b33f3c42f5eaf40c58f5c8a1bccaf
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 26db27d6c40360f32a27caf263dc97913c4ed5aa19dbec72840e364767d52820
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c5e66de3226302272b661a872a5057ff67b32fdf8c58b28789abe112e363132b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8484bd2d22626bc04d0c0c859a696639281d8b32ed13184775d3c8d6b6ea487e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4669622f9ab123b67604810859d42c2edae887cf35d9f9024da19b7edd41f73c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d159f2ff3e92bf51f1816d6d19ca3c97ecdece240c745b48972e616902fd50ef
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4ce2dd5bcd8ad7dfae4eed971c0b122a3977a3a8c5d5a0ae5ee654f4a4b713f8
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 332aca413daa9a482228c0ded7a82c8a6bad0bef01c4a983bcd1cdb2df1e118d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6d6ae6d6c310b7a827f0b6e9d8d1fd79374ae3883e65a3fb86d364959fa4f4f6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 288506a2da8d9120ad2f117d440724573808ab329e83793d09231e8b46f30943
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 39082c5be7c8be73ebca028dbb71f6c81ac29300b2c63ffb837336e9e977f460
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8294c4c1e5c8347c88860aeb52f88ba1d9de635e0afd3baa3e12f3ede98637e6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 cb9450e84f40121373b06beb7295ecaeaf887b151d8daf5ad7177f803cb1c90c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d9f5bb2754d78f967dbb06dcc85c09bcc8d79fea687f4bb90fabaeaca8b6f638
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6dfd6c8ce5cfc0fb503e7eddb70af427ec0d138be563a73717cb6d746741aefa
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 84ddca467e9cf74f4dbd6d6a738ac94e31959204b809a0efa41e0378033dbf0c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 98f81581a5c3490a7a76f2ee4fee6041e2b9923fedbcef04cd6f9bf8563bb245
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b25d3097bf09c4868c057540cea22b7eb6fec921bd8611630d4b32da1dc4eeee
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 75a9b0abf806343085ac74eccc8f4934d8b66c588891347f392ff9acb68c3041
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7ab2413df436a6d2e1ecafb27d98cf53168a845bc33b1b5c6812af6cb45c6930
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 86c353e27f9529dc83a2e88b776dd0b523cc559473f06eb15000cf865618358d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f30a3e2e5e2d831772c030366de745cd1fb0e064b0d43e7976781237414d5621
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 46b5ccc39796b088a9f3d6c6f4443feffeaee40f114d8c17c94c978997362408
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 947d52841c82b5878d6aef2bbe94fa5ed0ecb70e499c774ab7730ffeb2ae7b32
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f0397fd17e1bea68dc122a62347c29ca99f15e32fbb4d171dd9e6bbcf957ad35
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 051523db2f9fcf66c191177e50e64bee5d769fdda52e3e94aa512314e0704610
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 cb140064c5db5e40af1ab6b4ec5747642a0e7fd0af78c7a3d535ec343f3510ae
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4d49b73b9e869bf844d0b244e762f509cf39f40342ba049160950cff061e64f8
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 40005e38288a33d2f61a2326ed761f301f538e77fd43f7fb00170b8af1d44c66
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 3db646d4defaa3f5bbefc890be4de34c733922d33ce450573677b1e69bcb9d08
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2655e154260e35fc2b252e97304ac7dbb89736da9195ec202039a6c16a517750
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c368936261c322219eb838b5f8df4bf61d3c1b6feb5072a72d7be30d4edf7249
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c39d4c9e9d3123c92b6d01cdae8222d95c48f64ab92123f7ac299e1faa281599
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 3406d7775054b3a3253706c2eb2154e22289a5cd340d0f9ad9ead48fd6e24408
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 fdba39c79179c34482a4e885ba0fc7100f34d1dc0b9aba2eab86c7f9be953b80
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 460ac9b3c2ffd1a92dc17ffc0954dbb152c64f63440d6342c9ff03f4ee77af7c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 610927dfd64008e6d97e3eed45fc1995dd78b81c935eaffc7508dc6fb5b39d1b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4ac2789de79e0d02f8e2ddcb58d26a1e7e6874f1549c6655c4def2c251ac434f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 199a0ea52bf102e9b9165a07258636bbe827696ed6dc04ca54b4ce5dd3e5d7a9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 93260791ee841724b2ad5b2ae2b109ab7e386b2e21bb46814774ef570771591b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a84135b96bff68cb9a3caeef32f8703ff839d336cea6ca467c3b2de2d51c7469
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 47bc7ea399a80c1a537b94ea6a43318693b6995df9e7396cac9eec22b949f565
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 79c760e4aae2665edece002a896971839dc8e6e832c30a8966b5ef40343c66db
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c90abcf57c7413f0be8ef62b1b23f0bfaa7ec5500b5cc96b67bf8faae2ed8da7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 3ddef90cbe4034f0af1a8e870f1e94da752d9db7dac667d942e227827fcba43a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 50f4a5aec85577fa0fba31df5e3f9283f28ec297aacc51d2590daf38594e816b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1b370e827a4c7e4932a31e04c7b0144c74fd12e7fb8253b053eba0b8c7506425
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b0fe0b3fb0a32598489b8b3fc6da0199821113c4c98e82e306584047331f767d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2e18bf257d3d72fca31acaa9e96b7e03b0fc457504abc064f82fe84f99cbdf9b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 81a765e96c3aa069cc0fa2ede0a2e65d45e3d0fc8bc3d7f35e44420252ec47c9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 834ea6c46b41e1725be60d9e2f464a49e27bb4a23424f4f2e7351639ea8214c6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bab099124d20854ab6dec92374fb2d609b28d92bcb73b71cc3d7cc0536448eda
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 54d6337deec9abf3d3ff9747f0b83d7b4e5ecc92a2fbfe9e68d8d618e2c7280a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 3b175cede89301e060bbf78a036ad4764670036387be6ced1a0b5061d602f866
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1ea8d85b8639cef21cde34ff38adde30ae66599846427fb3627579f28d1eed94
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ec1df1ff7c7d60ed4cfb5c1088acd42e958467206cfb77cf9298e2b0d91cb054
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6790b61bb1b2d59f8470bfaaef15167057b339278ab5467f46c7caf8ef06bc21
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 89f2df325fc9123c7303c51d86b38f14b9ab92d48048ba6fc1c01d0d587d793a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 cab3852dca9bc256e3c0f7244e369fc532a81a5f8644946167b47ac54dfddf3f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c9133c06ebcc88cab50dcf670804fcb0514030c9fba7b545400bfdf78b6f87a5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 dc63e94490be8cbdf23faf87e85ba801c02b0acd98146c3bcfa6c61126d228d9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d3f46138cd65446b6a544a4b98bd46c5eabf6a147d6999e04fc35504bcbd2505
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0352a51e897f6cdd48c28d90733fc054c443b799d9518c136b4310454e4047a3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 3505440b4a9d0cdfb8dbf0deabd1215c8d1dbad1519b88a7ca27dc9fe9a162e3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 355ac1c0e1a5bb691968a7a1b1c9c203461eff35835d209d263b06ae7111a513
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c4a6f034746641a3fd0d0c0bb7b0ff74ee0ee6ad13c92d3ed0a397d4c9d02698
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0e5e267911532d2262d354380e72c1ab9a605407d32ae2dd31c30d715a354e3d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 08b42cf7bc510a19c2e8bb8fc3fbe4897e2e47e1afbc9df9d1b27012ff38e5f0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 dd98aee49e7f4684d6faea4835fb7d43f1bc8781c58d84b2e213d77f9b7a6899
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 716997da29c2e327c5d23589ff5752eaed680e6ec1b39a83e3d416ac34c8ed03
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1491ab1374af98ad947955f8e49ee072b37b71582be2342d977d2f907f471818
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6a380bf32b8292ca09034a4aa670914289a99301a3d1bc9471d9c8b3318f46c6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d720e05b31b3c222c8e4d7a447d3554628024ebcb68b0a99c13f96fd249035fc
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0b732d5646a13c895ad31641dc50fa66f4de8ebc74b414ac0da869bcddbc5deb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 358375c1bde8fe918403a5fd0e17a3fbfa6a210f3a4b786cdd4191fecd7b41e0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d3c2bb7b436b9648ce6e74da50470e80cfa0a2837b0519ac7ea68c922934784a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7cb31bc193ece902bc50df0d4d9535ac1786e0bee5992a83b4592b9f601ad28a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1e9d719a5ad815470dfac32d7a50a32ea07e3869afc1f3967bfcbd8b3e69fa85
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 3e541b7bda46f6d5123dfef0a5fd774d8480db917a851f14e6e2c26bd0947472
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 04742473c8f83d1e4c7a2a0ed63fc9dfd04155329d87bf8698c564e9fb601c20
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b47afe2fe89aa3f0986f88dbe6f21c25c9aed2cc4e383bb99b577520f71bf246
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 11bd27ec547141c06f500457a10e3a97423aaea6685406e913f7cbeb2f76cbec
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 58109e7e8dd29467bbdb710fe30116b4451c530fc74c99f5938896e3e40c0478
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f81b5c9f1769d5160ec22a9082aa760538ed26b6e65ae9afd929503ed42631ef
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 be99ce41b33151fd2760f80a742e6ca8f7856a007159d4042d1d60392e8a4e5c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c6cbc4bb879bdd6cd5a4f5c571b0368f195e91076f2ef56b1238773d2f35401c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0ec6549f8d1b1e78d806f9f964dc98b7f705e345ea71fc0c916915d7c40cdbe6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f39439a8fc77798712e77583403150b484c02cdbb9416422f37722b0489d4c3a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a03ae74e3940d98dd9dcb6ed2740b8e8d0c306a078deb31e630ce2e2f11da135
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 160b3d386ed1852afdd553f2da35091f1987ef5b198ec62490a30e2f974c841a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a4704e0a53a5f9c7547fc733fae80cf509462de3be7289aa37019ec1f46cfbe0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 09ec770fa263b1094f3998352ed11b3d63a1d4939392d8b8f6cf6b0df745e2ba
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 158c6ff4e55880c379100723772debcc7a80bd19f879cb644217b768720a98d5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 cf5fd32b63a050a6bbae8bb0473dd40ec0f5f6250b04e6236e374b2999c4e987
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 512710aaae3cac8a4ed74e41d1147f18ca31d5ea61287147c28e1fe2d083c04a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 624601b1e7df976fe94b3e43d8ac4c4d2fa54c652113e3dff04cf8cc592a441a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 dd03cbdc99e67b91179df51f3800c71a6f0a059aa3ed58e40512ad3b8400fc4b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c95d3733c34477f77e002478b6bf791c5faae2b1735566fbcbe9521e85789ba4
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 397aa91dcd524c7e0246b8c5b3acff7948cb1cf3ac92f7001e705634bcd0518f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 330abb3af6283d9ffd6ff5ee775fc6affbc4ab7b7700337fe5956a66149473c2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 27a9947f6e609ac88bff8db6a87f236b39f34875accfc0733db8ab298e84c18e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 59a2089c4c1400a9ea95eb6d4c36555ddd0b8c805e404e84bbed8b20b92ce4e9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4e08ffe1764802c17d10675772860b8141d367c23be9cf5061c344598b8d51a0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 75268fc102e390bae594e79d7ad4593614a8ec24392918546c668680a890c5be
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 60f6d09d0204c4e870b75104142dbec343e301b742fe97630c760444a371886a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 beb32b7d70f990e81136db64ec62d142f747faed1f2e5a3c0f5b21a6fe446cff
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 3c77e94fb27f3faa5df824a1fb09bfcdcbbcad0f4b4234f33f3bcdfe476918ee
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0f0863288a323a3ea85238370effbc7d83dd613396270a7253366c7b4263bc3e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 512c78b3a48efd1a969eff4aae6081fb78722b19b6f5b22d5080e2dbe485dd9a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9624d6720b174a97cdede2c7fc0df0b7b73e7ab495bdd865e7e5bbca6dd99a7e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 46619ccbe1839c95671b047bdfee13872254e85545c9b996a14a70f0b5e1cb6c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d1c4940e6e981b6e0e85fae8ea4e68e6c1173ba2bfe353ba480da8bf1da6bd53
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4eca30fe9c7c72230acdb8b6b2c040c29daa0545dae113b5529c523570de0415
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9f1e48afca29051409c821b9791be1be592cc11b572027f106db021627327f19
                • MD5 SHA1 SHA512

                logs.dat

                • Path C:\Users\Admin\AppData\Roaming\logs.dat
                • Size 15B
                • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
                • MD5 SHA1 SHA512

                servces.exe

                • Path C:\Windows\drivers\servces.exe
                • Size 550KB
                • SHA256 cde354f099e1a042ec7cb8f40bc672234c4c0cee8d052fed3915ec4c8931d61a
                • MD5 SHA1 SHA512 SSDEEP

                memory/1048-13-0x0000000000850000-0x0000000000851000-memory.dmp

                memory/1048-14-0x0000000000910000-0x0000000000911000-memory.dmp

                memory/1048-74-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/1048-168-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/1760-69-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/1760-157-0x0000000000400000-0x0000000000450000-memory.dmp

                memory/1760-92-0x0000000000400000-0x0000000000450000-memory.dmp

                memory/1760-2-0x0000000000400000-0x0000000000450000-memory.dmp

                memory/1760-9-0x0000000024010000-0x0000000024072000-memory.dmp

                memory/1760-5-0x0000000000400000-0x0000000000450000-memory.dmp

                memory/1760-4-0x0000000000400000-0x0000000000450000-memory.dmp

                memory/1760-3-0x0000000000400000-0x0000000000450000-memory.dmp

                memory/3188-176-0x0000000000400000-0x0000000000450000-memory.dmp

                memory/3188-350-0x0000000000400000-0x0000000000450000-memory.dmp

                memory/5108-142-0x0000000024160000-0x00000000241C2000-memory.dmp

                memory/5108-1233-0x0000000024160000-0x00000000241C2000-memory.dmp