Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/06/2024, 01:34

General

  • Target
    17a37f6038f839dbda13e1212594f101.exe
  • Size 360KB
  • Sample240629-by7fcsxgpd
  • SHA256 e53fb46aad194e134669b2d79459017a4a4213fa9db6c0d4f00d590c14133bad
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • mavar1972.no-ip.org:15963

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./www/loglar/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3364
      • C:\Users\Admin\AppData\Local\Temp\17a37f6038f839dbda13e1212594f101.exe
        "C:\Users\Admin\AppData\Local\Temp\17a37f6038f839dbda13e1212594f101.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5040
        • C:\Users\Admin\AppData\Local\Temp\17a37f6038f839dbda13e1212594f101.exe
          C:\Users\Admin\AppData\Local\Temp\17a37f6038f839dbda13e1212594f101.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1604
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:1796
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:4428
            • C:\Windows\SysWOW64\install\svchost.exe
              "C:\Windows\system32\install\svchost.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:2168
              • C:\Windows\SysWOW64\install\svchost.exe
                C:\Windows\SysWOW64\install\svchost.exe
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:756
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3948 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:4060

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 7a096211bb3aee8333f3724d14c84b19948a3dd3907987f35df17a01051b8c08
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 99f92c2940686c36428888880e8d3930f22226df3b3103b1669aa258044c10cd
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d47f0dbcb0a292b5afce6f7a6dc8b4406738c09291634aa6580d0dd03b71b60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ccdb18e65edac7414f216a99f476d799b9cfe5fa6a5e9c007c500d00be44f2cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c316d00f852d2e42b9f8a93bbf7bfd2bdb457822af54cef21a614b9579cf084a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a853a12fc0c61ffe9f93ac095c6f0d10afa286f05d70a1c4177413806776e64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 683aa53d1de6727912ad541c1cdc19e9322a92b378bf6fd9e7ee9e3730655ba6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eeb09b842ccf8b8d43eb889db30fc73955163d7b33b0fd3d6032e2cd6b568a46
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0427473e36ca91038e8347061c06da832027e3baad22e81a61dd15c3d49b0125
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1cdc39fe16cb4a345b6e98151c03108864163b8e2567c97341ee7ae24543248
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80c09754f5e2976bfc34dfae896de3de6b83cbc7a28b15557200790c14ec4cef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1c88d37f01421c1bdbb8101e4ad5e7bf1afdffc199dd263f16976218abeb9b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb0d4aed6204d26f779ee212ed5105f203c155f3d291dc341f547e25be1bc00f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0dda1049f7246c6a5cbd7b750340a7d9584687652f4a1a06298ed26ebfc9c55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef0e8c63cda8c6e57340f58aa415d50ebcb87726b949f6ab002cadffe415562a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 805ccff47bd837f690ecf7cea8bcb40b2ced45668baf0479a7639055807fcffb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6fc4f6dc76038306ccbce9700e25e285a4b1ed079bc495aa2fbca8b3d8a8744
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8d46e23e90e90f8c6746628e7874c5743c48ad9d7c1bc4e82807ef4b845aea7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e022377da09bccedd9c068ed753c0f94c84918b3fe20a73598c9f1b96b9c1450
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54740e781bf83ef260c6fefbec6944de47ae8ac6b40a08f865b809f4c6b9acdb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6575a7e5128fb7613fa2d675993c1dabea1acbb51d0a240a66ccca294e86ade8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c7e419a746ac9697310bc5970185dbf04d427565b42c0aad5692771aa46eeeb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b14b52528c9dc48d371cd3f8d47155ab3b165a1e25b383d763d934f1a4862fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77d228a73cafeab50e309ea0147826b7bd941bceb1f025b6fafcf083dbc30f43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 095e4c5cf53847096edaf5a8fad628428e75d6188c60b5d45eb998a0768d52b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6340aa6eb0e37db1d2ebe9e9a4379729e705b2c54d9a4ae7d1a18ccc70232128
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34cc62c4db09d4c72c22c31db7f8cd1c88187499aae73a9e1aba3dc19ce4c7e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 529a63f16be512daa59eba2fef67ab8b6bf5a5dff94d3dec305c092e67727067
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0049e61f2e596815768f193243eace3b03cd7dcdac674158c0b709b728ae784
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b92ba64e82cb90bd90db3b9317e3537b71b9809ff6dd18ce71e12f292a86133f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc008902fe6644c9d015cd49788dd8cba531155bf40c5d809e0389a26aced789
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cb4a07025746fb0af77f8c6f4c48045982835836cdd3a9128fee675b0583154
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2342eec00988771553c32d2d098b2aed8a23ce2c2618596b203f9cb3d385a449
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e599041b03e5d956bfa698133ae7434d06b28d27ecc9e99903c47e87eb092cf3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d697978186d2e05d02403fd319455c49e9b4573d603b20798337781d1c615036
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 856fc71d265ee2c72ad61db4b776861c0397b65fe47463d4b28b4930bbc50708
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99c2a19d1e882a8c71d1f2adc49a8f3dc02d02b51e7a32505afe72048659ea4d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75087c2c6e41b7f9573d14588a90b51670166cb1497821bd06dc458193c51bde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8d84ca50045afebad084c1ea8b73481b8695af1e21ff6e60e109f93035925b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec2b55ecca507b23d55c91f02593a1e67f81c1db7eab1bbcda17ebf725289ad2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef43e832721e1561d79c893585504b267b443152f8f69b194ae40b47b8cb93ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69837c75149a256e62192facb83c0956e823faf245592443ad3152c1c6538954
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95bfa4ae9ae053f8d00bfc7ba24b4f57a790d2ed1c5255b40c202e12fc1cbfcc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b664be4eedb32a9b984b19fba1332b03e7dd1a83398d31dd45decff772a6622
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3f5663ad8d7a2ae50d6f06356b568b2b4d7f4502128f53745411f62efbacacb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa3df980a6faf332950de88374db8500e76eb18db79a87e799ff1787389a74ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6702dffbe920914049e865dc385512c902e5c4101870a74f4b887155eaedf99a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9df392fddd4aeb48ededb3ef9a584364fa62413915bc5fc81846548531669e6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fc1db90c82cdbcb186057e24783599f47a73f1e7ff48840e8cae3bde9d059c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73ce9df4a8861577cafbe3c29b8e467b2cddeaee2029eff5655896349a2899a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 908c21ab0167a7230a10caa4c92ca249e52dc49c58d1255ccf670fc2be4050a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df13dd39635ed1e6de00afbfb44b5252961f7cf6abf4c9d75c8cd17e7f070a2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09ae07ba980b7fad9a655b5e258d1efc7c0f1474587bda99ace14babcfa49d83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d951140bcaf7e31d093ead9360f82f110b9dc2c422c3eb7db4496f27f9044c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a2a7bde7b77aab42db5a385792388f20c6ae549b17549668d3adef851736731
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39d9b698680507474500d9d66fcc98a1cf523f7836453dfae211403eac628d8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1de2e0a8cb29854fe5c1b7016cc296d926e1fecdf71baecf9c3157547c1525b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57c8562e635e88e7af64abc76987dc7828ea05d33094b0d27ef6e2c2ce0b6098
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9fef59b336eee9d0af97453d40163f9cc29c85d6c76da8be00497c17dfde1501
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f24f23cc0a1fdf260cada27d276c8074127d54480305f57f59e42c07906d9522
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7d7159f94a2530398235d6b6fddaf101721dc4fb66cd8f2b0fcc75eeab2e058
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1f6a6cb6da096d4d4da52561d547ff7fc8d40509ff36f93b70234f92a9f6879
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f1883a5d5145d2df085d8ce423415131b1b5d78335e844bde4e42b7a42e78b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b0fe84be809672c837b57bfe7fed699d79faf4bcd7e6288c4be72bd4e95d4f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8efbde528894be7445f12293bedc7e8dca914a3c31cb404e3fc6323f1948d908
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25a2f04c44891994e831db425a9376ed417dc53844dd50c696f29479721e8412
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f07230f0b92aef8aa13980a60a8e61790d5b8b4191d53cc02e10908cf2a35a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de4753916cd504cb9d1e291f1119d3467ed01b4efbdacfe67909fc3b28b4fa78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a428b4c7c29cfc323080653c07d6ee546439b7a2406119874948f0c70fb94c0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a97c2fc3cf222b34a86fdcb78db8327b7070b359d4d62126093af98ce30b23df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 335e27f4fee1d3a278f5997fb937be5d5e9230d69e15711f20e6ac8af6ca94e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6cd9f8c6b0fed508214c4f7f38180e04150178b5462e54ed614a77cbc8f4f977
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 911cd2e960478e38c2df67f4c0f18ebd17a6d9d3d4b433ef2a55520759ef95a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07a4815b978231aedac3c05de39cbafbeba2fcb367a55835df76e7a8e4d01a41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a34a713fd25d6183df8a61d50f838d8602f6e4068d16cfd88129382f65b1425
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d00e5220ff203c83c423c89adf514c2fb174499861626d02564c92a8de4f74e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1de4835fdac36d34f33663a3364deac0e5494b991a4afcd530e04dcb39f6293c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7aadcb0c8da268138a2d1bb9ded27f3f1562a8014bbade1454da9680f8933f8c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96d7acfd0c3278ae837e4a7cfed80cb3e7ff1642a70bbe63301bc16020460a0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f40d7ede87df1623609e2ea5856843744d9b96d71a8363319ecf9f3508f5857a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3485a873a639ab8b9c846dc9d7cd5bf8bef1d556555fe846cf2ed57274c25ecf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 707955a8a1c50c3f63b5b673783c203b6167efc43f5d9abbb8f791b8e40321ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d047b32191988336f5878c912c375b2d683a2497e5f37a974717199991315f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43564f39a5ea52c3cdbccd0116780255538bff1b25956c3dbb071faa2e9a0cb4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ff6bb9dcaeb29280b33c63b8acd03df2e4cf817febb280cd812110519fb5a75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9a90c318c9dbde9352d6b5991c6c505adf296bc2efc8db2cf6b2fa2b5b94f70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b514fb843a48cc2e042831e8d8da8822ab8cc53a3f9cca8af0876840b43df5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3cf834b4652b0c526fa4db15027cc998db0b674861753ada335803f17b40a87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 783d6e9da80fe3cc10461e1a6c782119775cf11cffbbd05520eb82181da18da5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34fbeb5253eabff6101513ae3c35a6c677d375ddf8f2bd92233d39ec5ef92123
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3cc11bd367fa4429cac343055a1c061861fbe33edcabcecd3194bc2d7956b2ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e0ae8014f309bb30f6ab1d62b20ecf0c07718b5ffb9a711f526adb68cea7159
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68c4515ac054f27958c3f002427297bf73b0e0e3c54c5d1c1a69c99301070430
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c21f0f2c6ffaad99900733f71abe5a0d043eaee7fec24f778817f554e61a0c95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a6a89669b21b7ad795cc696c675e0ca679553f659101ea5334983e4c6a6b444
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a70a7e8569d897855b149b8d958ce6cd88c52040d6dc53c8ed5a27dde3febb96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a8d168e9dd06ec5ba5ae24b21306928469fb6f6ff261917f7dd221e564b3592
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f7a45b7ee71fb07babbbe6a3923b608ed3ede7f2b36087e53ccbe6baa6ee4ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 424ed7ac9fda1a62fa70cf55c5ff5907c448848c0a6a3691730ad1bed1bce5f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2edb2c2021c56a98e645dcb5b422a652fcf2aab1ec35e81f70cf8072d868942
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2ab4cb6d844abc3a585a2223dc03b7682cbf689f7dde0ba8a601eca3f7e19c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78a100eb11b1b5bbace7d6fdee0632112bc4371730c709f0c6e52e7c9d005dbc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9acb055f3bd317b1c9c9d38d099d1f28d0e45b926583613beb11b9b34c3eb62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3146ae0e4d17479ec2e16d1aed9fe8fab9d3ea52cc193fd881d5840391338c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b296a8220977d9df8059b92c138d45486391c66a32c03bb7677aa5a8603c274
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1989a3c6e4224c4d2eda48f580322f696324f08e2fbfd6d11fb16386627ed284
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3a01ed5f82783cf46b7b4c5b95da02f33e970269c15df72be9a74f49e77da0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2174ffd5ee74c86f4869ae0834c157db95d4089fcd0c90eb06137558b531fe79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93bd7b38ee0cd202a4cb079011cbc1b02f59991e589b31946239d20346ab10ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b02edd65391360d33f763fca7057ec0b16cb65b364f19c5a3f7bbdde60ed5c64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b7aa219e0b9a4204641148ce2dafa891db4b2d5c14b8ddf82d018969701fea1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 058e0e48fc08ef20215a06ddcaa43c7ad2e55e465204ba9c09c66a3f7c12f16f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bd61ebef9d45065a1fcaf0ca6f794ab9a9ec94766387a1e7691774b2de77504
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0038ccc44c8ae06cef9fbc866fe439c45ca23e2ff03d25695a614cbee6b87c4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8ff7e2baf1fc56267c02c844b314de3e2b0cb02a52f95770d0c4f257ac4a584
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0564ed3223ad4ac2450ae17529a940cf615779910e2b0c17083643cd6f3320b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a32c9257a0287672ae86101920c5ebc240422afdd63e932bab5207b36de2df3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3eead85fb8e0a17d0a67482a7ed55c7d2a8917a8f54f509b1bd1b7280f03487b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca18cb098c670a36e20aac4634d732ffa37e5f1a9f0c5add9b110ae88c96d7b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 912006e3c030dd43fed68a69e8719f471449c90d0a401a7f865bc89716b97e3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21f82649cbd18c4237c08e57ce4c3c0ef398a579db3de50ca45bb1167d3316fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9fc195bc53bbff9fd60a645c4cf9e04f2205923fff62ee5648affd1fc7d26de5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4d6d7d1a82961f9aacf792e8b4b0ca5bc5f72696be425175186fe1754d787c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 086dfc476dbb5189e82c38811dbba421464ac20e6ebee823e082e53b3fa2e8e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44b7f40a4b83f73328475d63343d8cde2a18417dfdcb281f896ae9463618231f
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            svchost.exe

            • Path C:\Windows\SysWOW64\install\svchost.exe
            • Size 360KB
            • SHA256 e53fb46aad194e134669b2d79459017a4a4213fa9db6c0d4f00d590c14133bad
            • MD5 SHA1 SHA512 SSDEEP

            memory/756-1024-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1604-13-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1604-7-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1604-146-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1604-14-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1604-5-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1604-10-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1604-9-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1796-79-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1796-18-0x0000000000350000-0x0000000000351000-memory.dmp

            memory/1796-19-0x0000000000610000-0x0000000000611000-memory.dmp

            memory/1796-853-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2168-630-0x0000000000400000-0x0000000000418000-memory.dmp

            memory/4428-147-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/4428-1313-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/5040-8-0x0000000000400000-0x0000000000418000-memory.dmp

            memory/5040-0-0x0000000000400000-0x0000000000418000-memory.dmp

            memory/5040-1-0x0000000000540000-0x0000000000550000-memory.dmp

            memory/5040-2-0x00000000021E0000-0x00000000021F0000-memory.dmp