Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/04/2024, 14:12

General

  • Target
    ed9b87cbeede280efdc1829a16236b59_JaffaCakes118.exe
  • Size 752KB
  • Sample240411-rh4mjada76
  • SHA256 09a004a46943fa6520cbb8365db1ac7f3ee995514f59fe0e00f58a5bef961a53
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • legolas8.no-ip.biz:288

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    windwos update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3444
      • C:\Users\Admin\AppData\Local\Temp\ed9b87cbeede280efdc1829a16236b59_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\ed9b87cbeede280efdc1829a16236b59_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3424
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Windows\system32\svchost.exe"
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2272
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            PID:2276
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:4760
            • C:\Windows\SysWOW64\svchost.exe
              "C:\Windows\SysWOW64\svchost.exe"
              4⤵
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:784
              • C:\Windows\SysWOW64\install\windwos update.exe
                "C:\Windows\system32\install\windwos update.exe"
                5⤵
                • Executes dropped EXE
                PID:2876

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 8e83b857728948110c86bf2390a59a8a029e436282f9099ef4ad0ae06aa96aac
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 230KB
            • SHA256 1f84f2f5bfe2d9f6bed7050ec039bb51b80cffe438f1bd6d0ec2d72b991cb29e
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5915dc0d0359f4b9ae7f46ba600d34656fa6cf09dbde3a75c9becead559a09ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef1db0aa2343880b2e6885339392190e392ed7fe1b93eac491445095f4b6285a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cec2a460e6a43f319dd30d52b7cf4876653a63cafd23be8afa7946c52c8d6769
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea676fa830b9896cfc239bdea26720c11779ecb4c4500edef7ace92ece5b4482
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f621115d8392873e4427b3a291c532c288c6be819edc5016a5e4dcac4728954
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 422452555fefcc3fbeb5204fbd416b25d8f628e42623103e4c3854e67f48c8cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32e7d662ca76f1a58f4f4a785b1c5c6d75a73f7ca96659ece41a38229f59effc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d210c0cda2a6a4d603f89aa6e38593e304b0e536547fce8c699a82c59c473e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b886d8947c1b88d4b4db596611e3367bdca5d48fc56e94c00553318d609a59f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 700a8fcc5930e7afd920e653f20790580a091ed00f3f5d4cc044b1d7c3a14b4e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3140c27f0654d61af1c78ea9726aa844e8a74968192000643d83354343e8e598
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99a68d22bc38e88f263fd6aba16628270e2baadd4be55d7baf7347553bbaaf4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2eb8e366b3e878ec70483264490e00883b3d89e41d570765b3250bb2e89c47c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cacf6b727741f3fb4a5b87923778ae3019e4594842aa89391cbedd4a7c6584aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d221ffb4ec60b07ec013296c4cb9e9ce883a00b4d6066fcb29a3466a7d9fab0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b14ac3c054a75c677e3022cea554fd23a3893a4fb7477a0be7be73f2a56ca8ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6c4679e3fabf1999a840bb79595c78be43646c832b545b6da5e9e5881b45115
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13d292bfd76974a5beb7baf2e2afe8ff460ed93db09f3a420c293f8ed68f3da2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d66ff6f1967c9f1ec7d07577d1802e0c7b62c6b0c24255822658fb435b642b84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa4b1bb92edfa335432fd0cdc3838e9716fce4e029a4ddf7fc81b959136716ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 034c02740599d1e985b230f9a7584090de451355ad314f0f1dbb6f247b214e0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc895c101bf7fc133ffdc6662908baf8685ac1618c1112df726bf7c6d7abc638
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89604659b4a6ed1dc730375f3fe37162916809e1c8cec1480709d1f2960b377a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bf4c5955d57238418824168a1486aa874503546b7d81fcde47de0ab2771715f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5d40eeaa622a4017d9b4135e0b3114350562b37ed9dd1385c3e4cdf1dcedf69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37fcf7c3e26ee83638682548f4688d33212b7d9e8048adabf0409735af10532e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58bf26c4b6596c3494be23442b4ae44e599052ae2c61fa188f9197b3024da3cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75a9dd441317b5a77c67e2182553fa80324ec84cb6761a0be3f04023855501f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0893a596977267897f051fe4faa9280290aaf635961d435eb593eb79ba8ac559
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99979eb6ef279c9758d2a29f494108c9e24d2ae0108cfeb0043ded3ee5d33d4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20ebcb82486cac5680a80cd57940513705046bec3ac80501d91d092ce4aa3496
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6b93ea5bdef8105837530008bcd5dcbe97735722191ea62ebc6432409d32ea0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 305fd774ddb9f42b5295598ae92223f9ddcd503e69390c7239f75c91be663cea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f0da711c06ea9d7177cfd0019da3514472bcdb8f41b3a2db56c32cb461509c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7d7a6dbc16c1d1db5bdccf51aca4362c0ab24cdf12389e1482fa8935044e65f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a8fee7257341f2c7c4c3eccfe634f7dfc468622ab20bf54cd3bdb2d2350b83d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23374de6ebadb123ee8abc308dc674ea930bd11b1346a0d0c6093a71b3870c43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c37723a838cfb773421a0f117ea0cf233890eaa888a36a98e1297a26060c3b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ca66cf4670052e9ab234a62c6ec261d80927d3909b63f30e6857174dcca324f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7ca2ecc716130a5d8aa96e5f880b091d30fb4edf1e30707de1c2bd7cb619afa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7349dcd850dacb10a3bc483f4f533df460ffe5880b2c274e3baeea0cf2a0761d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90aa8dd75f820872dc5931656f7de44ab4497be2eba66820d095f262451062ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b8e41550c3fc0b66c1cf39415c64325bb276e8010033bc879b290df43a70967
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a4577cfcd6316bae6146a8f4161d48c7758202231bc0bdb95bc9c42d32ba309
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ee2448ff7f0e04d4174f94f3fd0297403945eda75897aba88933794a4dc238c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 851c0836e2d838b011e856d2d4fb6953b66cc90ef0f9f2f5b031d827359c8c0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbddf61ebf9c8c57ea10ab525b72b14311671ceb0a616d3584540eac08f53e65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45a21e79d8290f5d6b96efdbd259ea92a5e0c9f643e247bb492524ee35c701d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20e3a8ac039d44bc4af492aa1ca58237baa88de0af8ba951134009606fc64194
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ddcbd3299aeb264615d10a3fd36d8ecd403e423a2858883ee399edfd3125d99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8ebe867bacbca4000e1827f86188ea17c3f3cf01f1e68d60ab7b2542f006ff0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70dcc815188c4f0f16c7b22c1231579d1452dcce1bd55ae1192dafd986ac5f51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 038ff527f71e255928ced05ba0d9862bda87c4458c9f6c7a8c2d844f9a2849e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6521083eefe9ca170045c20e05136078a93fabc2655a72f3c9f6fa2c58ff4402
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a813af42129ad8acf424163bf9e38db89ce006326a8d481517ee5f873afe596
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58dc79ba2341fcaf764fc6fb1fbe5df7fa78fe4a8ef7d312013b0a5ddd9666c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d3c88e739d3ff77e9f1dab819196b19c0f1d0efe21f46871aaf753635991294
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ba7a69c5aa7b74c14c2ebcef445f5d62378afa472ba6fb7a2f220d7f67724e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51b04f2d7106e393cefcdf231c71740ecaf3cda4b8841635c1cb761dcf172cec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab6836c4c50805d1b482cd1fe57a87765ca56e63915251350d3a5b1333519204
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d561622fc766d154fbd2e106c7f5ceee1eafcd35f34dd3272dd9c4a2696f1a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 447251e36abf300e8c6f309533c5854ffcc304d602308b2caa170d417c32b3e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 042d98c2ac52ad0b9651569dbda151baf781a5e66590fd68a8b2272d4254d0cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 934ed9213563326bb887480e76d9b74b36d0746140992cac69bc0fe758616575
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bbfa540427e605f28953f3fd818e3f11708a047bb8e72573c067a994ac04301
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb94f2a7b3cb5e0d9a9336b0f59caca5f96e1f6709cb950a6a8825d76fc129ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0265a6cf3eac2e9c5d545022968a579504c990fb328e83dfce385cfdd3335387
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dcc7ae26e5fd9dbb3bf20c5cbad5b6e573deba87ae89ebf89a3025223bcd076a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3428b02fe45b085200994775529be5ef7a01461463274d927995810c41bb183
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4046121bce889b08a2d266dc6b129c6d7f3e675e70382877dcf086275bb3f55c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89d74f1c602466adb93ce5b29e83a2bec70fe99035010f4586ed7421f641405c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7e33badeb00ff3180dd961123a56dedea24aa9f09ca367eab588c1fb1f12c2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ade5353aa5f8a8d6c7cd14b0be1e23eb55b87b0524e387156f2fb54177ad2f74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6a61ad01f4716c7eec96de49e7e61bbdfcb482daf8189db938b77787fa220a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a8855f4c91dd59c1707ccc70f13c9064191b3a06a8f37ac54729dac65b2c478
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42eca3b11eb7b134594dfe56a0a1414ad4fe96946d1716b081a2aa47fcc5946d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55ccdfdeae3acccb1c0e1fdd8f737a72352e8cb0eea9479276477fcc21a70701
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7764c8758d06cb0611a6ed6a079a33dab65b0dcb72bcd7e91569136ce62bf2ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45e8145d0e86bd850de284982d69c1c5c3cadc67c9110c73ac3561be3c4fb840
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 296b182a2244e748747cb9c9c1770bf2f53f7366f6d57f25266e61c5727f8326
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44cde78d81c834f824159e7b7315aa6836fc89ef6050f56fcbcb70c5db7b3ed0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de2f57b47345851d288ece56a2bb1bd7fe0cf2258b15483bdd2561ca0354a6cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ff2e4425d91a8db458864e7da2e3e331241ef9fc8bed5c434d770c9fa3ce3c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 476704c148859680a7067ed658aaf4db12b10ba9bd9ee54a8273dd25eec3575b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ebbe320b81d6d8e2c09220d724bd026a8eb15174cdf565ffc694095f6ff7341
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c1ba095ff34e2f61f521218e14f1db7cfb060bedcf46803ba5cd0eddf0e6ec8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecba75eb714487a8b651e3972b25c61eef6ec8ff7f32be5dbf0e7239c9b9279e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6731f5bdbb62efe8dd52a322c14d9f64ead867b14748a91544e2a554430e20ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8db81785d20a0dbb9ebf73617a12bb9340794c3a7b539d946e95b3e4ce24134
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d0c4ce2a7fb7f1e978a95adafa7ec0955e70cabce12b143b05136929b977adb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2a3b687cd5277740f220687db863ca4f8f47a7c7a128a2b9e056e0e96cdbacb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc1485843915279a2996dcc136f755d178330983eaa3cb582be960503d7365ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8de3b2ac62f9208cf4a7bd33d115c98607b51544c32173239344bd3d27680bf0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58fb3c777db269aa0dcc39040cd2938d0147a99288c096df3991a4a141649b9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b226ec5946dcb9e93b366d2508a22d101320ebbcb6a13008c1e14243948b6d54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 123ca7158bb8e5f8eed10fedb9392441bf7e9f9cace1082124549ee0c4dda082
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6fc5f58d0982865d15639451332b664dd95b9fbdf016819a9ed84d5d7af2ea8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8075bef0463ea81a5ad14000327fb0534f7ebdb97d698bb11c19a8179d08d802
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47639d81e162fa7040fccff2ee012251f5d388550ccf335733e0d787d191731a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 924b4c986df394bef53e016e11892160263269e647c83aada51a7f5cfb1d334f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4c46388f4ebb7f7ee1ef768de44c6bc105b79c84c6249b3e98d00fb4efc334f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fb17bc16ffd67c7548496d1c97f824c1c68e5a04955a3f4d0f69d842f685f3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d761ead82702c38ea3117162e37b15ac333ee4424b5f0bc9e5795cdaf24309eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30348e8ad0dee3c8b35c214dde5c7f9d1affd9972852f5f89952b0d52c89db0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e619de87694b9d9d72c4b79b5c35530b9a37c5e6ecc832bcba1dad987610def4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ed15288d2dc9f097131be8f8c5a0536c9979dccca6b81aa25e301e42fbb41c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9390eeaee0b1a9ee08d70e5d86bdb6945eb9722ff6701c8094190092d1814cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32a64822d3864814b40b6e54e5e531bb69fca1d139a64842e97ccc18bf5bc27d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 038872b55cc2e8675cad1e3bbf2b649793631ac509364b218265fc910b1aa071
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2dee4e17848b85d8de53889d685b1453aaa719afd7aef3bf33b63b6f04ec0d3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b122aebf23f5633a9c0cec15f6e5524c4e9b7bfa6e85d0e388a760607668025
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5f4c7f2ed6adaf9a8ac9137f974e14e0797a0e66995fc948982ab247d79ce12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 898704b59f2ee4de1c2a44e48059ab8b799bee0eb604bef92b9c07a1d68f6e9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b42e558926a44f4c43d6e5ae4d18c364f9289c08148f2de8241bc0d3feb82af7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32b1f15bbeaaf686606dff6d8e7118bab2977acb265c5de4de2a3429b82c3ee4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5ee5223882978ebd01f5a75bac64d9977c0fcc252ec4a8a1cc4f04791bd261d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0e6b8735d66537741d2f95fab05f26ea51ff6986603f1ac337a6b8e8d66ecec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33f20f91e7f90a37a92dc4120be4d5f17c0c3cc422167faa37b0d1a17703d72a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d283881efacb83786a826bbda44754f13a9fe8a63ed38d80d758d40a6c0c97ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0db071a05e2961588da294b9c7f75993f674da6d27fc764587df87370f6ae01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a444ad11afa245c18e0f211f7e38fa7bfedfffec5d15cc6a91fdd05510316c48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd3c95ad158d8ce7021731f3b8c28c220913e2226ca86ac712169f70a70e1052
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47c7114ff4b8caef6ac94bda85036f4b24d9b18a5a016249b7c90ea5d413c6ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03fa437aabd954fb2a4fa80adad94ba1ebf37e0426685580663fee09142cbf99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a730c6cac64399da67f9e14a980216ee8741c1699631a51d5626b1152c2c8bb6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a71b1b139770257cec955005234582c27433b3ab7af6fadc3b7ede65d379f11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48ba0b2533ea6869da908333f69c166926d3d18c13900856b06f122b81e07aca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ac9e85406b23cf930fbc1f7cb63169c241c2cb7a4d1df817881f60f2195564f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc7b9c1a9cdca46faba9743f8b31b1b7267232f3ca910b712ff385ee61c06315
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43b7be0996d308296b8dce3671d02c9e22d652a52fea8abb186d306b0046dc99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3993b29240e6b26268195ea8094b44eb892b346c6ea0198ba5bda9d4710c09ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5636ff57ee41d5c9b3df9001e2eaa0ec46ba537e2d1b6b4581d86e1b38e129e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dab5413b081fd2fe937ec8b8c5eeb763402f88b46ccb6ab5a5aee383aae4fa20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f889f212f2e3ca2764923d7df29d4186c025cbcb5b7fea33ebee3b00bd35b78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e9e3f37bc1cd12185cd5882efe31d844a00d83b10e2b68623930a8d7649cf97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c17e7c4c6bc3de2ad8791092d23251ee7d4eebddc1c77310421131809889b0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45f69b069d9890a60a4f75b08e3d0b8962068a21870848f5a242939f9da95af8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 451dadd3012d63f138deece95dc3a8b004957f19c91e53261c7d6c5485b41d4f
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            windwos update.exe

            • Path C:\Windows\SysWOW64\install\windwos update.exe
            • Size 45KB
            • SHA256 5c3257b277f160109071e7e716040e67657341d8c42aa68d9afafe1630fcc53e
            • MD5 SHA1 SHA512 SSDEEP

            memory/784-1464-0x0000000024160000-0x00000000241C2000-memory.dmp

            memory/784-152-0x0000000024160000-0x00000000241C2000-memory.dmp

            memory/2272-77-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2272-12-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2272-9-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2272-151-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2272-13-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2272-3-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2272-17-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2276-82-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2276-560-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2276-21-0x0000000000490000-0x0000000000491000-memory.dmp

            memory/2276-22-0x0000000000550000-0x0000000000551000-memory.dmp

            memory/3424-10-0x0000000075140000-0x00000000756F1000-memory.dmp

            memory/3424-0-0x0000000075140000-0x00000000756F1000-memory.dmp

            memory/3424-7-0x0000000005720000-0x0000000005730000-memory.dmp

            memory/3424-175-0x0000000005720000-0x0000000005730000-memory.dmp

            memory/3424-8-0x0000000005720000-0x0000000005730000-memory.dmp

            memory/3424-11-0x0000000005720000-0x0000000005730000-memory.dmp

            memory/3424-4-0x0000000005720000-0x0000000005820000-memory.dmp

            memory/3424-2-0x0000000001820000-0x0000000001830000-memory.dmp

            memory/3424-1-0x0000000075140000-0x00000000756F1000-memory.dmp