Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/09/2026, 16:26

General

  • Target
    PERDON POR NO HABERME ATREVIDO A DECIRTELO DE OTRA FORMA PERO ES QUE ME DABA MUCHO CORTE.exe
  • Size 410KB
  • Sample260915-txhdyszdkd
  • SHA256 e72858efbed6a5191b07d1745ead8400826fb5ac202f0f628c5e627af0a2ef02
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.02.0

Botnet
  • remote

C2
  • adri14gay.no-ip.biz:81

  • adri14gay.no-ip.biz:82

Mutex
  • 5O334LO225PP80

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    win

  • install_file

    winr.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    pinomontano30000

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3264
      • C:\Users\Admin\AppData\Local\Temp\PERDON POR NO HABERME ATREVIDO A DECIRTELO DE OTRA FORMA PERO ES QUE ME DABA MUCHO CORTE.exe
        "C:\Users\Admin\AppData\Local\Temp\PERDON POR NO HABERME ATREVIDO A DECIRTELO DE OTRA FORMA PERO ES QUE ME DABA MUCHO CORTE.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4548
        • C:\Users\Admin\AppData\Local\Temp\PERDON POR NO HABERME ATREVIDO A DECIRTELO DE OTRA FORMA PERO ES QUE ME DABA MUCHO CORTE.exe
          "C:\Users\Admin\AppData\Local\Temp\PERDON POR NO HABERME ATREVIDO A DECIRTELO DE OTRA FORMA PERO ES QUE ME DABA MUCHO CORTE.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4528
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:800
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:4016
            • C:\Users\Admin\AppData\Local\Temp\PERDON POR NO HABERME ATREVIDO A DECIRTELO DE OTRA FORMA PERO ES QUE ME DABA MUCHO CORTE.exe
              "C:\Users\Admin\AppData\Local\Temp\PERDON POR NO HABERME ATREVIDO A DECIRTELO DE OTRA FORMA PERO ES QUE ME DABA MUCHO CORTE.exe"
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2268
              • C:\window\wine\win\winr.exe
                "C:\window\wine\win\winr.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3988
                • C:\window\wine\win\winr.exe
                  "C:\window\wine\win\winr.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:4076
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 532
                    7⤵
                    • Program crash
                    PID:3028
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4076 -ip 4076
        1⤵
          PID:4176

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 e71851e0588804fea7277c4b04dcaba5ec90b588b3578dc07e3dcdd31605ac1e
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 291KB
              • SHA256 6dbe703fa7bcf76ba761d58b7eeac048980d31555e03eb0f85459c0ebd05eb8a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 749c89f126f1da4be3854bce08e11abc6418bfcfe295599388545605c36e4c68
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 19886e5f9e40f3566fdf94431e94242ae7094195ec58ea0b3ca578fb5eba4a36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1fe40affa1dcbd3b748a8f0e959de46824f7b72878cd63028e707160870ca58
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84c41cf7219a130efd2f79452aadb9ae6360161e2ced9ade35dd73d53da82b86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3937c7dafb00c41adde461f5b9c917bd78d2de78e11f1fd31e988fdcb3e6e683
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b9dd92375cbb6154634909cdfeb659abd09920da987996689128c65499f8296
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c579a184764d72c005a6ca7de11d1bdf90711c96883f06c6db9b2a04a36f764b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59e10b5a44b3bcb10593ea97a2a310fa578c30bf26a2ffd9948e7682e7f71286
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d1e1ea11c4f48b97f15885c2fc95076edfc59826fff2a28678a1a2f5f018f9b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 18ba6c900680086488734cbcd77ac43475b78165813e451eaf2844522ffa1ae3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a47095c7c6fdee8c559336c376a858ac61d40a439a9279298a0765ec6bbc70b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a28ec68c98505805781b543cc35d809c827940920e3d14e5ab8a5fbaa0748c4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5eca5aa54d27c48bb5eeb09f77f30ad49f021efa81685f53eda2359cb8c1c044
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0db14fc2c1437936670ebd435196f0c8055349d2ee0871b7a576f2b2d9608a7b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 81662a0bb8a8f00dcd1a2499952d68e9469b37e0bcb9ecee7d1c555bc09d038a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af845198303159d8bed103212dd602ae7209ddf2dc8ad48fbd31e814a056f774
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4906c4180e73f01e37530a127e4a76122a46e1be65759162cb47e2de394d3f0b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c370e50bd3fe81b84cb95016237b1e24ec9838ccf5d0f36020f32d53b99fb79a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9f0012fc704e301b2b9024bee470d3840c55ebb8341c463f1bea546eae83a27
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 feda3cc43ae5f3c370926ee9ea556eb16ee05b93f4f4af703689a09d65780d59
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 88f83cc06e2802a30f0afef04639c756dd5e562d9b4813c35c790ae83b420236
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 273d600cb00f89ddb96c0135050b10fcf7f3c5b3cb60cfa0a0844a8b7c6fc0b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 432e1093c2f5c7ed600bf03aa20337787e0243718e0100e6aa34f9abb9b60db9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6e62aa73ef85e3a6daf65d7babb54ad60e0d97f368ad8b059df0fc1ad14f068
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bea848eb6064fb70850147a7f79333b5155c687a0fd401bf78777d71ec09c831
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2622724d0c8646cbb1c95fae1310ac4cfd8fb0e515b1afc6fe2e3a0b2fa846a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f231a2c865b00a538585d2be6968d6f6e134de620c9b4f7479a5ad7f9c2caa5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 32a860bf8793faa7a65f493a1986e2de0b7058927e433126a014f8eb4c193654
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 686c0a915a90b10f74712bd03b141916f86b604e5fdd7a8c906b6df669c7c63e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3401e61b62bf4244c8a8e154e86fdecbfba041601ab0dd5760203e68fd342199
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 698820d96e7faffc0578ff7c46ae9d823ea9dc7b4a528f060ffb2ec7bd6db34d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 09a4c50ede21e8f8b2be5f54c6c64cd337e00c4cf8b450e929dd2e64c3570212
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 abf6c1e71e8e773a5a22dd064a39ffde87a4d957519458b4ea16868cf8d0eab8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ef2cc2c4f04202f1db24ba41c4505bc8f43a4a2d3fd29220e6422b9b2d1f29f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c1bc2574b31760c050106d2ead6b1e6ff01c619db72e360e3a895dcdf05989a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71f28890a9bcda7034ac220ed3002fa14802cdfdf829584a5d0c5bf88aaf5a7b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8477c207dae569843f5b020c8ff4769554c6356d83b4c0de25fd44e921da75c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72fa3a7461db5bc943ac5b99a9a8835d56a408839d4aacea607e30612c06e1df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed9bd3e6c320581052a41f640fbbb75af3b0cec231e5e320a65823c47d88b9ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bba9d92b3867ee61308f49a967a760496e462231c1c20c7199fa2c9195d2cc82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b14c4211e60823243d500ddf70ad655aeb2caf2fc0691fad82561bd86f0825e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7070cc9e4f6a03125919238312ab2abb53d99c39627788dd8101bebeb5c23b4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba8a4cee5f4b9f4d85c03ec9a124d00d30c9999f4762e4756c130170a549a751
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8538a33531c185d60eaf26715ef914f13cd2d46a566dcec916e00b230dece48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e83b293cea09400f730b0497ee3b404df3f45eda937fa69d9b453b3119e9c6ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e660ab9a3d6a8d4d04877621a5421632800b1589c7f84f672b28451d4759dce3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 27571bf034a8a68d91c449591b5a1a1b290c33647265c02697c005a4dd36f88e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a0f0999aaf48f303e9f416adb42f33a5a1230985f44be86a5ed7f67681cbbe4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0d3ceae12a84f3e480db0e478679b8db9a0a97e149a52473774648ef66f2a91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e99e589ec6c7c67a662bc455ed50d6f3229ef7c40c7dce6a634785068cd50da2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4accd8af38215e644b17c48e5c7e74755ce1a6bb8cd04cd3b6a89d9dd4812a8b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 036365a630f30df108b929c804e94e910fcb55e462e657ee07bfcd72d1728bda
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f3c2ec486746eeba8d763253e0611e50c329acba13f1ec658b16c39b3d4fb351
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73d06ceb7e46dfcefffa7a5f33efa9558fb061cc50058557cf20f2da4e7cdc8c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c5f533c7ec237f4e1a905ebfafd6630ff4a5f8bc9ace542b3f1862aa6ee8fbc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4c8363464fe85420f23f7b04a9de6a21328043d47191fffd5449a5e74fada06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0bc4783a9d287d564a81508b3b1c7a2a1b5d2fa6053f22495c1c509008081e29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ee4c765ef53d568684d5cf5ad161b425d42186b776fa8cfe6104db95c2640f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f4d9cc88c5b7785988f0c9e1495a2cb2ed756292068a2747e9840dfb47aeabc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3202708ca0992e1a91b102a632d03ea3e5b19bd25f1fe285e564bc6f7890cd1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c6465043db0843678817aab2aead1ade10628b0acd92fe96e150c94f6b0095f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fbdb9bc9abd212f1db65d20200d4fb5741896ab234552ea843f6c2f479ec7817
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c79a2988ccdfb2892b818eb8c1942da87de100faa867987fe5eae549dc8d4c61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 886bc920d91372f828f513e215583db6752ff20f22f66d9bdd183e13af522c52
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0195eb607bcbc2084793aadb2c49625703b37da8cc3576b1f8bb43cb9737b224
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9811e3b7406ec809ea25244b29028369b2e10c30f0b2735dbb5adee4288e6a28
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5eba1148bec8dbc861ba4a81d2f801d1008904642c463a3bf6333bea06306cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b5e527d155e223ec82f2920f4f176133139631a35faef82106c566228ca44e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7870c64904d3e88bc74de6ba108f7baa300b1570aa5c4e2bab740ce1efdfc4a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c9ac2298c8e4fe2c2e236752900a16910fd70884623f8317e4c61bd87cd6b4e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a60d5be1c448ecef35379a6c8c553326ddf87096dbc1f9154b7f9d6da2d2e16d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eaa1baf82a9d406bed9d6a5fe597c0924289d1a170acaba2c531bbce38ba73cf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ee5368b8e0e387e1640567f54a60ecca62974fe9146c7c6e1854b8ae626b483
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86a638710ff76789e29918028f72fc7ac54acc4a4f84b96cd0a39a3362d1d785
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0decd7d065ffe319177dda92ad13139fbcf32e15056c97cf5e9013eb785db356
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f1ac5452b2b359f6b7b4359ea0484f0c39f98118beca8034f842108fcc21b7d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d74804855dfe4109b6b60c9668d87df57ca780f66191bfca95db49a4ed275346
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dce83b0e3e0ed5a8765ea2b25363645e2472a3e13246098ca3feae37f46fc7ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b3561e89dc6a99a9f43b9669cc7cd439c4eeba5b6d21583b075553d5b11ca783
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e0b562a6be2154a0ef3d7f4608737161f768836610ab99a77b497fd09040b4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7bc3d0579ae38c7b7c53b493e88aa1c72358edb3735134301d500b1c872c860
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9eda35b3fa0fcbfaafec72c3f2ff5f73b0ddbe4ddf28233934d54b00d00fa93f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85c13c4f40cfe2195cde9943d59749c04df019c346c76eeab08fd5c1ad13c77b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c9f767cf0b66bd15bb0c016a2d2fd30341bcca0447d8a413e05ef91135d62c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f11b70152290d127c0e368fb47c513bcc6595f7650f97aa293e381aabc59d46
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2493755725df525661392aaaf42a7e5c28ce0bb43ad73983173c72ff073201ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 99963801d99d6254767006d6df9e954dc3d963579d8e9e360cc3fd42d2872b74
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cac0240c7d3a674ff5b0a15443669d2bd70335f3b648354bd5152396133cbc8a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2376c0698d986aa590c0e39ffc0b92f4e80c3e7d4be4e0310e5e66b4b10e2e1b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff7cd6cd8ab3f936e6692ceff24050493775570f2ef92da4ecb95b09ee7679b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0bb74b9ba4c3bcfd9807ad9f43ee923773e677dde4f3665200dfbbef3a7d6ff2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2fa50f7e7bc3b592b2a0b59a78039c4f1bf10b3a44f857dcb91d3a6c843adcb8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 262920564b1eb0061ac3dc6ab6d3bee75f68f7b1050a5f5c7d336d4fe7eccc68
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9d5a6790c5bb5bd1df25387860941bce7be65b3c651e4a8c800aa16fbbb7667
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2db35dc8b795ec32a0cc10d3b78e1622609c27d9a5553b280ea3cad536308ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8fab23c307f98365250e2f4b417a5be11b156ec0a54f46453c5b5eaa8b10ff8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 334bd3c871e581a1deeb7c8a260a945f5db603a41f1cc9223b81659e48de496e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d186a946c25c623799ad7dd5f395f8dcccf091878c6d51b6ef47b91e61047b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 187e5a10e8cfeb435793597ee72dc52cd8b83f99611e26216d20536852f18050
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f25f39a39b3ca337cfe6a4a12c1b6c7dabec5d22e54aba9731ded12bd186b79b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d52d023f211533de091ac5b17c002ebfb178581d7653630371c8e9ffc81f1c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dbd1608a5b7346b6acdf831fa414bce3e8f7305a2a603e9f2fa1a697149e56db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b00642b407577bc190d43fad6b0156acf4fb6dbf43c5b3d6f9f4a6be53c72037
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff3b1931a2feb3d40aa6608c3f34a4cdc5321d56e5fbcf98bbf58c5cd4c93e5e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b342152b40b831c4e0a27e995b8df49f8d31c82845222b129098d9ba529703ec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 552575c2cfad428fe92ab67567c70083090206d32053423a61b436c4ac7c2e94
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e94c1d947521b91999d20a22aab132601511573fe1870cd2bfe8766104d63a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e1c4e5e9eaf4b72d46732b49374b73b8a9da0e620dc39d4c567e4cf2c2ace0b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f915400d3125e7ce29a7e1309dd718ed4d74214931eb38219dbeb966d0864ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3325e973f48d27803e61950d21300cb64e99ed677cd22ba448fdad13c07d6711
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c8d9a18c30d5f887532029b801b218c18e6827f5123c640665acd84cc642a4a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b765c1bcb5a40601e13e758b10ca9efd655b8674a1a535ba77bb041cbfc1710
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d78d9dc67e122b2940d21c3e6160ae2b07d0ad4b7324245e373bb3554215fddc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cfc82e3fde457bfff3b9148b56a2a5052082781a9df545f5f8a7d063c689c8b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 feb4442af6a4119390937366f83b069dce093609372991f7146ba7427ff8c037
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa1edb7d904d2aade4661ffe592d09340d042c3e94e4d960b2979fe9b6b91f3a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0681b1dc0367a23890519ef586b21b46273713e17128e373041400ba39445aa4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b123f4f22a0e002f9caa9ac2c847ec53d55e9808d46e887650e0f278f94a7eb4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83b0a02bd0502a9242cae391b696a30aa8b5ff820717a7e5216da7c78b0d1bab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c88616c4d3a93f9bce519d4949b47057e87fba84fc8d3c0b2b722df3fc0fc2e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3db63040479c10c1455d9465906d4d74884abb3ab3ddc711e46667552980dec0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d375c73f8120e0355437cde3a056a62caeab38dd64e0f55447da3b7fac79922e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 61ace5eea858e1af4395c8cd131ba98407923dd133a1aa97cf7b81e31742a59f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bdf8e0bbf12ec8d4cdf6c0143c884cc337fbc1e94ac31ab513da456607094f1b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dee0101e6bcd121c6d0bdfc87ff5044c14e5692cdcf8f1d73ec8432b29978ea8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8babf6a7e74a65fd2a4916b9f53810896bb478d53b0d500bc7f261b5f6ff7d6b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55545c461cb563dce08e90a4091f71c38f2b4fefa15215e7657c388db6cd95ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c21fcf7a765f7d2f7d45f0e5732dd9445678ea59b9fc01571b13e535ee93198a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55ae613bad89e60d81d106ee61354a6b81295334fa6eb0a60266f6dac464b78a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9c49286898a814605af936111f222d90d1b89439de0f672612041236d30e725
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1a581bc68374552f9329e1e789c891885671058a1a7af7ee595f9ae74b34e86f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7750d46a98d2c0aa41359f4d051482e17f5347e6f0d45efc1d703ce47b77653
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf458e1b6fbb0a23c3e742e56591fea819332a0f9a86554eb5d949926b3ab590
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f7604090752462258a18ce8076d3ac59f62a37b9445f9e8778fb736f8dc0447
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 07070f0aa33d6bd9e98956e441560c2855ff6fdc8bede7e9f2f7ed995d57af18
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc16b15179aac95c5b2ecbc5279af8de792d9680f546f9725fae22bb589c7eb6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 431f09ba36403073f944b671468145460d945c80283b0315279f697fe7d0e236
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              winr.exe

              • Path \??\c:\window\wine\win\winr.exe
              • Size 410KB
              • SHA256 e72858efbed6a5191b07d1745ead8400826fb5ac202f0f628c5e627af0a2ef02
              • MD5 SHA1 SHA512 SSDEEP TLSH

              memory/800-73-0x0000000024070000-0x00000000240CF000-memory.dmp

              memory/800-14-0x0000000000980000-0x0000000000981000-memory.dmp

              memory/800-74-0x0000000000160000-0x0000000000593000-memory.dmp

              memory/800-13-0x00000000008C0000-0x00000000008C1000-memory.dmp

              memory/800-72-0x0000000003470000-0x0000000003471000-memory.dmp

              memory/2268-147-0x0000000024130000-0x000000002418F000-memory.dmp

              memory/2268-142-0x0000000024130000-0x000000002418F000-memory.dmp

              memory/2268-185-0x0000000024130000-0x000000002418F000-memory.dmp

              memory/2268-144-0x0000000024130000-0x000000002418F000-memory.dmp

              memory/2268-148-0x0000000024130000-0x000000002418F000-memory.dmp

              memory/2268-149-0x0000000024130000-0x000000002418F000-memory.dmp

              memory/2268-158-0x0000000024130000-0x000000002418F000-memory.dmp

              memory/2268-164-0x0000000024130000-0x000000002418F000-memory.dmp

              memory/2268-161-0x0000000024130000-0x000000002418F000-memory.dmp

              memory/2268-157-0x0000000024130000-0x000000002418F000-memory.dmp

              memory/4076-174-0x0000000000400000-0x000000000045E000-memory.dmp

              memory/4076-175-0x0000000000400000-0x000000000045E000-memory.dmp

              memory/4528-81-0x0000000024130000-0x000000002418F000-memory.dmp

              memory/4528-4-0x0000000000400000-0x000000000045E000-memory.dmp

              memory/4528-3-0x0000000000400000-0x000000000045E000-memory.dmp

              memory/4528-2-0x0000000000400000-0x000000000045E000-memory.dmp

              memory/4528-138-0x0000000024130000-0x000000002418F000-memory.dmp

              memory/4528-146-0x0000000000400000-0x000000000045E000-memory.dmp

              memory/4528-9-0x0000000024010000-0x000000002406F000-memory.dmp

              memory/4528-5-0x0000000000400000-0x000000000045E000-memory.dmp

              memory/4528-78-0x00000000240D0000-0x000000002412F000-memory.dmp

              memory/4528-69-0x0000000024070000-0x00000000240CF000-memory.dmp

              memory/4528-12-0x0000000024070000-0x00000000240CF000-memory.dmp