Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/05/2024, 15:33

General

  • Target
    10d9488484135205c635011c14eff309_JaffaCakes118.exe
  • Size 441KB
  • Sample240503-szn4vadb59
  • SHA256 94986d91cb3d0f3de612a63b4d7e9ad005dab44a05e895499a9cd5e8baa544c8
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • creditoshabbo.hopto.org:200

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    RUNZystem

  • install_file

    Config.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3360
      • C:\Users\Admin\AppData\Local\Temp\10d9488484135205c635011c14eff309_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\10d9488484135205c635011c14eff309_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4020
        • C:\Users\Admin\AppData\Local\Temp\10d9488484135205c635011c14eff309_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\10d9488484135205c635011c14eff309_JaffaCakes118.exe"
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:868
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            PID:1680
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:1440
            • C:\Users\Admin\AppData\Local\Temp\10d9488484135205c635011c14eff309_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\10d9488484135205c635011c14eff309_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:4652
              • C:\Windows\SysWOW64\RUNZystem\Config.exe
                "C:\Windows\system32\RUNZystem\Config.exe"
                5⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious use of SetThreadContext
                • Suspicious use of SetWindowsHookEx
                PID:2528
                • C:\Windows\SysWOW64\RUNZystem\Config.exe
                  "C:\Windows\SysWOW64\RUNZystem\Config.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3636

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 28675efef929007a0fb5973cafc5d1871bcd0ee3b04fd20b1fa88ab304a61d7c
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 43579d0d60dc8e9f3f407f382059f2cb203bbf9e0a9f6f3bc653e38ff496dea4
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d07b462dbd10192b5002ad7c6ee5252535e4e4d946c08aa1a8ef6e60883caad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4c54e60ebc9627e64d4a39b01080299c4c68733e27b6adaba1193b4eae23860
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28bb8702b78b94a164af4e0deb35c6d014f9bd81c09d819de303bb4875d8704a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6223d7523156c2dacbe8e5c8980b0c8b89f6623c76ff758cc71ec35df15e3593
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7192dbc0e89e663e6644f8a8e57d3571c03273ee5b07778d6e9a3ebce13f5e3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 079466e8bbf18564f3b90890ea4f6db1bf639e776885247ed1c1b98745e81460
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d292b2b8ccba4c1bd380589385da80e33925eb5f087eb520c422aa5258e9df29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fe029517d9224457697e1481fe441b856e2c95c00ca1968e09458c5ccf9b763
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20f7b14f4c0d14865cc448baf6235a56aa449a4292b4303bea56f93be912f64b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf27ecec5f2ce3110d0ce795cf77ff369f43c3791e9550ae1117a4ec437e0f5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5153ccff7f27a7ae3b2f5475118e28c1f7923e293a8b694dbd18a88287ea2341
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1020f5fd25ac97282b94defaaa0cab450c62dd1dd738d0e13e30f33f648840cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43fa2f81b2ea1accd95916ad6821da88b0b8dc49a955cb8f125e955c83c08072
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 700c1a950fd6594e09ac18ffbe9b237f09e278928848d4560e7f82e35105f7c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 883b8117aeda820aa414d97f5e0bbcc123adc1299cad4410fbb5e6860191399e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1e17134800bfbdb89d3e60e5a1116af1a4fdd67ba6b99bc82a33dbfb3c0f461
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82ef3b51e9ebddf2fd0a197f7678df76d81a66d1fc8440d973e42dcb123aef27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef1a515c3f1a746792f44fb47928495bd68be701f771ae5c4aa2a32c4de83d31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9ced501e1c268b9bbcbece83008194da188e863ee09214a6f349335f824e14f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9df2815c3d6343e7e3b7cf18e63a9640ba736637235f41491109e2c7ea9d9135
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf1a8243c326cb3e3e0bb512303351228b575b2f4467a31210daaa2a6a703b62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b680ebafcfa6e816558ff2876b0880cafbdf2304a15bc3dc2249aa6964a264f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acf2913625be2c235eda9bcec9a6399d7aeda577757fabbce34d543706764d8e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b101463d56dffa30d2c9791a0771328f3d839cffeb2812fa6d430bfc8275b3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e41d65c6764a72b28578e8c80a27dba13ebcfbefcf43568921cc80598331146
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d493f1d60c382b2394d5ff403c67a83491fe94f0cd8e1cc38546d90184988b5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a1fd1b46b430e6eb1fe5a5e47005e5fedf9eb123a4a515937f0224ee6cb2f50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25b97f1753c8cb67356b258d087f6092140fc0fa4638c3d72971decb0926749e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6173e1c87a173fad18d7a76d45835b65b4cf1f60d5f303911d49f2e76c3b4cbf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02e0df22b76f0ce00802e6ff628cce5a8aeffbc3ced5e2bb9c391c227e7d86cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af6004195b8b6c0d83bd7ec5fc2338e971be269e9cbcc43fc2da96dc15757e40
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9e68328148e87286cf76be1be46847dfdb0c70a9f5aa35931e9668f43b87f8c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5560519e14fcdfee5dc77995092f0091a74afa73ccd39f0489ecb3477cc42e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb8e36c353938c306b2afb81aa8967f59cba8fa326b328de365076b5e986c2ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64e30caf121e6602d8693dee2f9f97e6ac785844c4a27b3d05dc6fde07223d65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 462ff7576dae8ad053c26d020b2f28a9965c383d76f2bb9cdae50631961614d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a38f38a66dd33060de43e1ffe0d98c822c1f573260d0f2de7709d2072fb83694
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a296778949b808544f5a6a68469df1fac3018c4ea6012885655c16713221854e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34b407abf7d4bacc3eb395053c82e682db8fa21dabda2cad5ca6fc77e0cc3364
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f95aa84e81a9e90a65452ba715f8f2f7cbcc42b15f14d3b286bc9c8f76e303b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 840b5bef5210a9d67f5a13a3b0529c3adb53e6bee24dc8f7cc12c897c35f8f24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d08f5e5899beeef4045adcf1e48b31547722f69e42abd23c63968072751e4f3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8014884ea32d4dcdd7465e5ac5d3b0ea0c34958a2500b645d8d3eaef4680f9db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 460523c06040b9e30d0ea6d3783f005b42151f46c202f6749135d717196566fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1af21691b856a7b7ae37431b66d409ef6c66a6d372330256441b26a39e55600a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30dd40d8e84fcb12aed88cea31e2260833bb4295054425f9e15068c80e63cc04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e4ed3edb83d99bddae0d12cee95d44e908a3adfdce5b604d0491cc21c789476
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0df658915fbe464b7ad3b5aec6ea7d8b6a4699983c524d5702ca1eeb6261c4eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2817309cdea6dbdff0e97e9da697f9bdcfbb94b3941ff72190c0d975655484a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0a621650420d0ffbf01fa335d528b44ad7f09c8227c1b63aee69cb4f3949a9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1865ba019a8399c075971e7fc2a568187094ebdca1986d0d73b0277b2e7a6f99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab873a0a1f97ad9ad747023f102402c0a608840b25729a93f1cd5c5a26570348
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9aba020d3a06c034a0679047a1b02724e462b8f354ce85a392ed580da10ccb4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 470bd1d99645e618863737c7f1c54dac88b5b8a158073ac70329105d2efc39e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34d9d3ba3b3378e9a0ff7df9a3f27c521b651cd86f058b8b2a0fa96443a8ca98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 055b74387d1d30f81c6983d0a3e4f23213076e668f538ab7a90cdc476a9c77c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 605d6017134f686fdff3077902d3e117127066738a8d18739e74c8ad5af0ff3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5a280d6d3c6b2740575f2609d68e0d693be27ec6a14dcbc82bca5c806903ffb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4ddff14011174e2401550e6a31a1404a618ffd92bbe795742e82ec692fb2198
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46bf416d6681e8d16191424e0a6fcb5299d17fde2b4b38e6b96936636195d38b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ea414ce79486197ecdb1a4b0059c4bdcb9f4c1fd88e9eb9b9f35a78a4653324
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e25e2179543cfd27917e4e85c26efcedcbd533ce6433f48bbb56c36e418730d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25973b593808c2b85a0cbfea1bfce3edff087243f4d70f0e4060cb0c144e1cb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bdbde4d497dcd2ba079d2361eabea686fed35ecdfb47e43e08ee9469d975df9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96e629be9e46207e3b9498022748dca842ed4cb2519a0bc00701af118bb83562
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec0972e95becc37fe5db4b9cbb667cc1efcb8314bf20027540e1b2255224d528
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d69d3e7f831749205a9d3eb8112e2ab3ad1aa9ab3334732993ed531227fb963
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7332ef4b56cb473ed9cd92a8889c745f022b68f9a3cfa967897aef72f12364c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e49f76dd0c06f68ccbdb1df4b5addb63bd4468dd13603bc05cbe6f7982518f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 daad63c029310c1eb15702ef8fc191349d48d41417af9c76fbd5a617eea42ac5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 454482aeeefcc7304c048fec263ebbdefc7896b00626eae17ec4ef0c638f281a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5c4c27c8762caa7dc4bb00be4d78fbfd48689a1512f4d1ff8485b6a55866fb7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 270c1793af7f6a87fe441ead761521d0bbe9207fcfaccb1e7b26bad6dfbaab78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3bb1334a6398867eed6b07530166d2694ee46b63a412109aebdd64d1ae4b015c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e79f6236315886a9e08408868ddfa0e93f3a307ba3ac10e0b896250b81003ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22c1fb85f7aebeb0b9bda7d40257239ab1cc07d1726852916657fa0bf7d9ca58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b04b4398b8f1bceb9c74fb5e0e58e32c6919e3f118049aae96f612c23614b456
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce3675b28c09ed876df6048f5a0563fa2261f942d5824534e499c541990d4d27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 727bd241f24905e66886b32325a2560c9cf7ac9946917fca3a945ce40fe63b0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c7579e8a1822ceb277e81ad60415bcd2ba1cc1c35a361003ac42deed90f12da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3ee6010c8ddd7f3a7829f033500fe03b0ba000099083f939985e944f1e74245
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d36bb787e7ad9d722f8afb714bb8dd66bd9721bbda8d7f5649a885b451796093
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db7105b23b502828d5953d40ccdfe25dd27feddb05e1368ac27fd4c1398908eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ccc559252a5bc9e94af0a57c8a83b1d4b3cf1af5eae509eb7c64a47c722ce207
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de498cc59c6c39c08e3be18c5b6587bafe2aaf33d5838dbc8c64b7d2fcd2cdb1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e6a6cca65994bed6817c60bb82d807712292c484f47a7e78253233621913b62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e762fe1a8d67898fb7f4f0a33c691a2976631b0a2aac8c9bbd7bdb5969e98db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9e20aac8ecc6e42d889c0241d490faa7bc1833328f88690a93351814722f259
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74f0d8b4a640025b9086c9e926f5683f99fb63b0ae73e9dae5a8f786ecf065d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6685ae67f1dff41ae9fc72d19162731d28bf340bd07491c2467df3b6e6a1359
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce1e6119fd3758df700ed9f56a26919802fb7640371f55f8ef9a09fd35eee05c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57dd4f36d68499859ed83164042923db4eaf3442987835c76ca2acdaa177798a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 330401652c1e6db7e59b843588f0d715d566b6f0e82c2df04e9e2de11761d936
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fbfa1abd8eb97459f78e440f9820832d2c9cd67b4258c5aa85481a465bc9aa78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d2bf78c4bac4c101908521007c9c45a159917290e29a26edd049b6fd02ea1b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0131bb7dc13ac1d14ab28aa5cac750494a6483de278757b9e1a7af7ab0fe5ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b1d75d4ae1661c4750f339129723e1b5557b7b52b726bae7cbcd76ef86aca44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 329ae2ecb43c2faa1bb0c4b407643af8df4371937a4ab7c3e7ed6e995e4521bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f55c56cca5d2443faadabe197d2ed486410bf4f7224980cd0a6b80b3b6da2df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dcd1065512af7d4c3915b8eb21e4dff7317e7a7f62672ae067e0d1a58a5de3de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9bf54058c2744141992c40857c648d784e168a86ee50e48aac24d24488ea0f58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 692e7541d4b8913a76641864c1203e42dd59d6082060fc5b9a5e629cb6507f6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f13e2f2b64164222fc5c13dd7e7a809057fafd80e8d101913cb5ff6a29ea33e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e018b864efc894c277040fc8ca16aa6849b93872e0a6e4ea0349acb349f76e1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8d54f91fb8916384b1fc826ab2c5a6980d71caa2b345a1cb4f6e57183a8c918
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d70cb49eae72516e05c94d3a709e6deebea94ea97f3c68bf7dd4f6e24a5bdc1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 673a9b2c95086e56aface9b1ce1d93c7f3103ee95c3d6b33c5479ca3497bb9ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0d063c922000382181dcb8550e00a8f7016638dfbe4009bc5369de41eaf38f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8db0453b57854139a61d88c9e547793592d43da3a1ed09e776be0cac3498ab9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac68d83e66de6ba5be4524fde7e419056b02c4a73973a1cecb30ee513d23ab1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e01b579f429a039e08601814a179adb89bbec430c1a7e668c8f6f604170d9d40
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55dddb3e8e0e9578db7fbde1617a221358e8cf467c5c48e68869c2f05d525114
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc02587b806dd1321424e5797b024ecfbeb5deeab5351d37f1e7fc7ca2bcef3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0621669ef7f5be3135736923abc99fe15f3eb92b9f689a1c0f14c3d05863b4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fde1c5cdc642fa607e6ea6b6b2964cb98b5d73e5e744e241d7bc848c57d50f28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9b91d21e564fa0c62b2e3337076c601dd53beb703166db9dc35e0203d9c4db9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b36fcbf2ddd4a30faec35b24ad3ff36d43887021d8916a0d9d196e1ef1f36f39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a68ae1ef2552d03519c95e040db0629848dbb8244a9f3519f3e37221d7e8f08
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93025f420026d1c60dd3a37a3d25c3c6a99850a7998b9c564a8fd4efb31f66f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3fb2df0adfe931ffa0682bce18932bdadcbde8809ef9543abca6f28e26886a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30fc1ba5c2307aab4d2211677664ebf85e6d59fe8f27639a1712bc833fce1e68
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f882514b13b94891795cc7aefad9414378bb3055661600cfbc96902033a58b42
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acf381dc043c1367b097cbdc7b5ad9a6732de1391bc32f65db37b9e5d0ca05e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63bb32324aba04a2ddde1df706e059be0309b96453bf9ceb4960fa957efae55d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f03a8453db49dce25949db57590b4748c7c44460049e7e5a2c6569fabc1a62cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 042f1d6fcea8351c9f6ba880220c08ee3b1bdc275d6c418a2b349f2250be9546
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 767594cf4d4da53a92677de13d834a5998dae55824346943f1154683e403a5c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6851b202c297f15de338ed80039dc843793aad7e03ca42e13a653f44b26fb57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8b2fd39275d005308eed0f0be41cf12976e64d501031c75ffa018fd9ac771e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79c527b5693fa1d7266b0a532e7191892630a3714ccd96b613c188ad13d9a6cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1255fc5f3e7876c16c80cdd1d30b57343a7f47dd72da1b0d8c19f9cd56e4fcd0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 589533d3c5a3c154ff89f397a1ea12b7ca2ca5e47007a2dd0a0ac2b9f7631698
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71021ca3a8a63e82c45879e43fe4678a4d7fb6dbdb088b1b2aa30ad30cf960a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 339b854426129828e7305c4a305d50843148429f2de65706f51f7b3c135aab81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0673c0bb7a3b4f5acc2f8e46a827cd2c580da628304068e678800a0a355480b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a76fe7180230cf0f379e6a39b90544012b6520de364cb28cff700fee20b2950
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0101e7a8c88976186b3976eacf762015f853392ea2a8ae50b01d4fc35316251e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 634c6a81d513b8c71f09cc07a93a8d102467e56e95c897b4d220446852b148e2
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            Config.exe

            • Path C:\Windows\SysWOW64\RUNZystem\Config.exe
            • Size 441KB
            • SHA256 94986d91cb3d0f3de612a63b4d7e9ad005dab44a05e895499a9cd5e8baa544c8
            • MD5 SHA1 SHA512 SSDEEP

            memory/868-13-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/868-2-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/868-5-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/868-146-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/868-6-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/868-4-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/868-9-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1680-15-0x0000000001440000-0x0000000001441000-memory.dmp

            memory/1680-14-0x0000000001180000-0x0000000001181000-memory.dmp

            memory/1680-75-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1680-914-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3636-174-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3636-178-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4652-1371-0x0000000024160000-0x00000000241C2000-memory.dmp

            memory/4652-147-0x0000000024160000-0x00000000241C2000-memory.dmp