Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/06/2024, 14:36

General

  • Target
    02a9d3e5dfdc1150527844cfa980298c_JaffaCakes118.exe
  • Size 653KB
  • Sample240622-ry17ca1hkh
  • SHA256 6f0542089d75e7f982670c43c40e030e07409a47ac548e3b0a6ea9709ee1eadc
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • izmir62.no-ip.biz:82

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02a9d3e5dfdc1150527844cfa980298c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\02a9d3e5dfdc1150527844cfa980298c_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4240
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:612
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:1516
        • C:\Users\Admin\AppData\Local\Temp\tmp.exe
          "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1916
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            PID:6088
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 580
              5⤵
              • Program crash
              PID:5168
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6088 -ip 6088
      1⤵
        PID:5132
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4312,i,3833046924978547022,12404847742964713612,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:8
        1⤵
          PID:5304

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 af4f0d8abf4362086383b6ebc6084484bf87d1300bc15def9d2e48ae952f28ef
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 586KB
              • SHA256 6337de0a6f0944a2178138150383577f40dcb9bc8c1017e9962bdfaaebd8d08d
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a773a0aee46cef956c6615b0b44b9cf26f61acb032a6928402a96ac2119be07b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3eed6a6eec2a10fdeff032650a44af2260ca8aea39cb3f487c94dbdc9670c6fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b1d7a35ac731b5d98b3ec0c92d6d3f9d5211c0808627d88b3d51885eaaf1931
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd3152210c8ad5bb6a07d173cb277e6b66aae7db93c4e75cef3aa62c74317513
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 95f63c7f37b795befe6ab5c902b964d33a81b8f056634abedb58abf7e12cf3ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ddb50d4536e4933930c9dc8b09b3ab863f01405c958ae318e3cbcdd2191eece
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b2c100306a9cf00b3792ef6fc58ed163f4deb72603964e463e5f47c171313ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab9f569d8c4e70e0a144468fa06b62ba6d4b6933aa14c723c8845493322d9753
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28692bb67635f4ab0b6185520f68291a356dae47d9805e8fc0fe6689634e26d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd675ba071fbbad8d2cfc4f84a98eceb2b62879e842c0ce87a0496bfb291be9f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6797625040fd8bc6e89d83277d017eae4ad6adb631dbd4b634a377224841658a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f50cbe3ace733e7077d247ffc76097b36593bca16439e73806adc870f41d6174
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db6e1f9d1fed7759d9cf8ad41705e13de0aa24bb2b3bd57a480ab867fabe01d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 12db14f1c9ee0a6d0cd4bd8cdaa7e1ebf504a2f293028fcd8ce5dd192455156c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 24447818c33fad53e16fdee7a5262cc5bf12b70123b79c9cefda9317920340d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd606426e530faf44ce89bf88c1e04fb15fc25ef003f6fdca75797907dde2f5d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30d90fd2934ef519efcfbde0d6b94eb11e537dc4c7b3ffcd5150b869626844e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7eca9aeb5af8ca1c191be380e3cd03aaef635b5ac59ad7532ad97f3bff6e6752
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ed02f9c06edfe1d3d5ca9efa26f2ed6bde2309cc38f9f61e2dc61790e5f7ea0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 52a2c04ef4cedd6f8be98caf5fac9e7d6c4b35c85c8f7d3272f8e51c75436126
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b589df48a5b43899d72c7523c4ecf549b8e330c1c16159a523f3716576bafd2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1d6716b508c48cee63825982e742c814956399faa15f1104aabe1d87346b7ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 025c24b38e0884d075b239ff57fbe4f0a5a801be073db300c20f8520869e8705
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1af3992a94ecc12b4406f1a0329e09aa58283ac848161fd057b085b3327718c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 06700ee5fbebf94fe9e963b2cef647f5abbacfec9106c25dad7251cfd1df0960
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b4d9af213620adf543c1bb385d98b99778e49629421fcd7518527df2b488f30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9cd2981ff1f2a24a57c01a107ba6f29cc32581269142eb9af9d95f436ecdf29c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 710fb6f117a30637eca0653fdee22b4f11e93e1d31d9a165bea6daa007578877
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c2a0127cb311b63b8c222ff5a3253d78747beb63ea7218d511bb8ce7b7df630
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e4cd4ec7450167c8ecdd253febfc2e985ce45e33422bf46557ea35f47a82638
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41db2373ed1c5c67bd8bc18537e1ee9b64125a5bbb9ab2876dd3873a7c29211b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72bc8c630b3a79c1068cb265b32910f385b45a80891d65ab4c0e1a94cfa917f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ab6a166cba8d0cb790aaa0608add575680857b1646c3e5db99a43022c337d1e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25e1deccebd2f71cd3ca0239be92d8111fcb17dcf7f86aeccaac72c41aefc603
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a518ed760d23175da4ee23bcf1316232ba523ee893a5229a1b7ac8ca78084e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc55e4f72e8856ab3b9c3b6d6564bce404097f6645cea48f96e48e8cc634f4d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7368fe17d27af715903e5b91858522f33e94075025730564acb906519be1b74
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af66884c1bd8cdcc70141bca9ce7c57d1c2208ecc544f153253e63f204d4c613
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c4644f151dbdc822d4de8a3587b64ac0488c24279a134466cd4fd02c8d5b682
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 09ed9accb929aa1c1563624c41fa101fac78c8f78c370e72542b2eb0b3b309f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c24cac544a35f204e229b1406acc98776e34beeb6855d555120c0aa9a1df00ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30c67a1fdb05af62039297bf43f22bd823d5d19a5511b0fffa40f78a44f7f104
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df09e1600c284b3067b1eeae6a97c721006f6f6814bd1bba9fd083fccb448811
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff139f21548d5df743d5e2b742f7fdf9bfe52527ede6232ee24576db23fc5c5d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7f943a3fa16dd3da1abaedf0b612036fb7180ff9438c4552b0ceb1580439cfe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ad7c9a7d3a27fe51162c00420f3dc9da1a49d831dd9712e7581d38be46dccf2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d054eaddce41909160d3d8f486992acdb9dd24bcc029228661586e2db9892827
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 74862eee259c5aed3d6b3308b6d81e762bc6aefc2761f31ac0008848127c793e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72fc412dac0c40804dfbfaef4aed08f54113bc163c856bc214667d181de83b20
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83810d71827565e7ec7c09d20f9e0bf6bcf77e3d64d06b58ebca53e29d0ecb8b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eaf2af8671ae5f73ede96468de7b4781aecdc1f1e1d58acd8732fc825d1130a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 baa409714331d31b95885e684128ad3f79067b94234188d04d18e0c10eb1d2b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 227477901087c37471b55caa4d7eee43a2f5fef9c838b2d149cbd37fc504df07
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8454726913f3ee6085be3936f161f25972e85f2ab4c05e31d6293f0543e47687
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d483941f8c90731083d54f76c4e5799bb4c7e835da934f6127d9423fb5191dc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ab438ca3a2c15750a949a0049d0c74eb4c837849590c3ab4431e1d085cee6ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72ac38bd111a365385b3631607220806dc0e64e21fca5429e113e93602acf3b7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 656462f16625bdaa2832a048625a9022aa17c9d22ce18e382e900d2f41026612
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0f008cd2b1cfddca9a4ff6d8f9ec3f9859070e41fe313173dd73642e8f0d09e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad9a29843e09438f2c1af75c82f0567623c9840f45af670c976204a5ca2421bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4fd080da527a80e40d2e532b3679577b92dda34895684a84e8c7dceca33058d2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 32a44f0cfb2cb4c24cfd147579e54e4781eb658edf301295a0f4f948b70cc0dc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d050df51e353227fecdf22feffa475e66c30629d7eb01eb89dba78cced70dbf0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 68fc709f17f396d59a624736d3f68a6a50c05951ef8378fa27b2af5f4799ebbb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed7ffc7cb3aaa4065546259055c2331dc3bbb3300c29eea2eee09f0878bdfc4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6bebd20c47b903f25104eeaaec2b162cbae29fd883c5ba193296a789f374161e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4e4ad25f4277b3ebdc1b7103606221bf2fe33605c0dcfeb9691ddd9ac64543e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28bd3e2a4b03f99329b93f973b1d2fe337140709be4cdc62818ecb8868a1463a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e26331b7298fa87d80c1ee5363e5b15d51cbd60ff04566aea5a15a871d201ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41bf553db179068cad21521971dea22b2027f40f188a9afbb96c989e05320716
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 32b45121c6a2ef2835793ad6bcaece0f2a08033632aa7ec6319fec9d60d96405
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4bd8f1a302474f475fb4cd40d0fa92b73a4d2e7531c8441b3517ed3afa57d10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 831c71c2a4005e3d4281873f0c5254bc928cc3092de4318ddb8b44aa960a2045
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 87cfda31c47f75175e03cb88b8983874b0879006ec11aae0f4038f9d0e71b478
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a700282b27febc91d8aeb03925a3f77c3392c2bc7598cedc5337e0941ebaca1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38c74ebe657908e320b6db6697643a3b779a890c8063efd4298356459c3d8aef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e3698407ce9b5bc511ae42b0339d0a70a29b18deddc0e358aaf402a399424bdb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63f4392f88ebbd276a1de6ee46add4395b306eee23fd862dec48cc2630df451a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44e1d631346f7a2f401a3f0097ab809ea9797fc561d0c9b60b7f3831517f972f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d0239df0bce43df3903feb44dcd60411c960f6fdfe2c8ad04039344e4dad85c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 475521c67256e6aae4161e65261f32b11e12562b01402795a954b3feb5e723f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 589d8f8838473396bb9a8f356480b967d810319cd10a3412a58738fa241e0e8e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f684f664441ab846af66df13938234bc387be66f8dd663d8c6c4f40d2b0d2e9a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36b2d7ab6bf505bcde5abc550c08a76e629a283bf232935847017b7bb56cb723
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 82c28ac8cac38833fb6806b532cb8ffbbc64552e3177ac0b8100108f73fb292c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4816f90e4f36313197f2485d89b3c90291e54d239f5b50fd1b55b0ea860ad621
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43f79c85f2f6506297c4188f59fde706e44fc4d498561749d1a8b713e4dd2218
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 297ecacffed58ff04a3a30b27bfdc0322c27eec43b770a5d7e57f91f20da97af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dcdb1665138961a849c992d2a83ae77e406391a7117e03e8c1f8b58032b18e2a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85d3c666936667d2dceaf0aa1ffd01105b0494ba94b81e364ac537e6f8952692
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ff2efaa30e62147e2af482be0b2dacd2deb3a4de090fd38ed1abbf9e6ea712e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d3dd1cfc274696ea64d398612ef263d516c05d700a1c77575243162167d2bb8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c2d5393bf2d214126a63c876206586899359e682dd90f0c3bb991df2c5309612
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 900e17456e4f6101b6dff06ceca2a9d4c2847b743123128f6e3f8d83fb20e963
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f25973b222a865e7ded3b4840be05dbd5566ac91e463dfc9aa2d2952651bf411
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1476018b93d57025fbb84523dfd36e16f6da8aea2f2604ad52132074e017127
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 358e10851acfab4e3af8e7680d95f47ef7504a2beccd0a46a890ef97f8451169
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd55eba2791f335208dec00557cfa6f543c2aab8115d1bdf594e86cf7f208734
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63c53da16252b590030f4b64c18984fe28e7e478c0a8fc2335967344af15625c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c2a48af1c4d277ed8746ccc2b8e6b97cdfb9fbc94cd65c9faf5d01809411953a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 775f37526dcbacdfaf56317bf13685ab76910c98c44ede87911a6fdb64eec61c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e19c4889b803bdbbfd5de6b8c7cbdde96fae659d974f57b52fa57b3263010795
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 49794208973ee9f60fc48b24fcfefaa438ecf92586828cd57a58029e71f4ec68
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5638d41ac9530fd5b8e4dd25c29c117b803c61a30b39f297e99026a85a3fb084
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5af260949c6690375071561fee07ffed3023231817523d36ba738ccdb1fea696
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa1ab5d3fe599ba7cec6b954dbe36b3036e31ef66ac4f4b52450ae0b50237c65
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1913ee42f350913a434e5afa94a3fba046ced3efde28d856574347f37325d68d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a4bb70e505f826452a8d98b6daf66091c301632f1e81bdabdc4b68dae368a33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9da7c477bc29f274f0a6c5a263b4ab5aad79c9fbe18b7e75c10651c07b25c8af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 79ca10dc6f2a68f9d30df5d3bf9dab0c5aee728f60917bf2a895d3eccbfd8937
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 542880c313d6d357f303afd4037adda8fecd9bec69a777423feae97bed18d1a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34ce66b5257e81257ca7362328ce23e6055eb4a01bab8e0b06fdf92e595f5a28
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 005ca114d2a66ad6c34e778788982185376fcb6204df3da47d2bea2000cc7aea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e43f1d25bf2224da2f16eea09582acba94efa6fe77a5dfa85b764d6420d5764
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9aeb955fcf3e97d1b230e050365dc27c43bd25a520e8383bbbe3249dccebc32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e0777216c5daaef397083db85f273856608390d4c13f207f08f4f187d88709a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 268d826b95765d02969b9d040edc96135fa3ea590b357d71a0ffc1ceb1c48649
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 24014c49226f0e81d33f79715481bd33cc00e777faca6fad579c35fa106de404
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bfe46b3cd9c8ba25c92b160ed97636a88ab2fc94b4c0b8bbf7fa8df49a3b7199
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c782de75b24c6ebb982df49a9c2048f4f7e4691095607a2de3ec09427f7f601
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c8a3094c7dde75b41de9e98efd405e63431f10af7a975b84b40032bf0a23bcd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3fb197c3a08be2a0b0dcc1234dcffba50cd870f66bc5667f14ca6fc834f8bd29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 309fe8fb9c4e8b36afe59472105838511dcc77f0c17a464cbb042ae9558b9c53
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 68cba7792eec5c3fce462f027e23c65178b9f4e1120e172f6312f66a0379b494
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f239522bf1bac7b0b36eec52b65e281e468884384960cfa3e9d83379069bbb3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a3c6de582df6677279e04d222707ec273d14e63b9b0427ca2afb0218bdabff1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 950f5f0964e57fcc98e23ea1dbc0f52d950923025069b3fe3e36abd6f5faa8c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34d4379295725d3eefb39f8c942eb2d9431d12f94572df4d3818f1864c3cbb97
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 539b6a1d7c0a41da2f817efcc609d50e6129e49fe0a2538ed551dbb06d7c02e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 558c67b3a47f720e575ae00fd33e336dec97277a1fd82f39bff18448e6b08cb7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 490b32a6c3000c7634a3d1df9ebbad5b9f7d5635756b1f5801669e390408a4c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5fea158299d24577e335e09534c9344ae47b8d0a81c44446e2663816f55a028
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 454d54dd3ff0618e25b4c0c3f90bd6b2f718af3ec3257e479d7486592bb62cf9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e7d623df9ae81f8c85a9ee495806c613ed2f94401144c6ef6cdbb0204b50936
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0567d17789a738e00b94d9035642a24b8a9d8284bd0cd97c8252d72e764df3f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40aa8988af19e2dc3732604d4b5950f682fefc16fe9bd5480708b953ecc6eb38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e1ef3d55c32712eb27571f8121423b3caae72d838a9eb187d21f77786bc83d9c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5111069ca2a0fe0b31c78d424306309ce5ec21ba5fa7068d2d9957e826b77336
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d785c602e0b9ab4f7f21df37538f5bda07dc515556c285ba85b49ffb51f97609
              • MD5 SHA1 SHA512

              tmp.exe

              • Path C:\Users\Admin\AppData\Local\Temp\tmp.exe
              • Size 470KB
              • SHA256 53502e69da1af4ef38486e63fca79945f0f655b9cedaef00f25d228436d509f8
              • MD5 SHA1 SHA512 SSDEEP

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              memory/612-23-0x0000000010470000-0x00000000104CC000-memory.dmp

              memory/612-17-0x0000000010410000-0x000000001046C000-memory.dmp

              memory/612-695-0x0000000000400000-0x00000000004AC000-memory.dmp

              memory/612-11-0x0000000000400000-0x00000000004AC000-memory.dmp

              memory/1916-1813-0x0000000010470000-0x00000000104CC000-memory.dmp

              memory/1916-1130-0x0000000000400000-0x00000000004AC000-memory.dmp

              memory/1916-24-0x00000000001E0000-0x00000000001E1000-memory.dmp

              memory/1916-25-0x0000000000610000-0x0000000000611000-memory.dmp

              memory/1916-694-0x0000000010470000-0x00000000104CC000-memory.dmp

              memory/4240-0-0x0000000000400000-0x000000000040A000-memory.dmp

              memory/4240-13-0x0000000000400000-0x000000000040A000-memory.dmp

              memory/6088-720-0x0000000000400000-0x00000000004AC000-memory.dmp