Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 10:29

General

  • Target
    07f912c15a18c6d82a68f42a00b5023b_JaffaCakes118.exe
  • Size 316KB
  • Sample240624-mjkhts1dkn
  • SHA256 5a7890ad2d6f9ddc00c9e9dda0a3cb3170330ffe911e75ac3cdf62913ef82cca
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • aw.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    System32

  • install_file

    cftmon.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Aygýt yüklemesi sýrasýnda bir sorun olustu. Lütfen daha sonra tekrar deneyin

  • message_box_title

    Uyarý

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3400
      • C:\Users\Admin\AppData\Local\Temp\07f912c15a18c6d82a68f42a00b5023b_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\07f912c15a18c6d82a68f42a00b5023b_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4988
        • C:\Users\Admin\AppData\Local\Temp\07f912c15a18c6d82a68f42a00b5023b_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:228
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:2964
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:3612
            • C:\Windows\SysWOW64\cftmon.exe
              "C:\Windows\System32\cftmon.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:2216
              • C:\Windows\SysWOW64\cftmon.exe
                6⤵
                • Executes dropped EXE
                PID:4452
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 564
                  7⤵
                  • Program crash
                  PID:2624
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4452 -ip 4452
      1⤵
        PID:4704

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 4736cfe1ce262c42ba21d7c38e8af9f0d09aadd2649bcc193cf74931f7bcbb92
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 c0c5f761d89ce9605ba55a40d1d977acb0fd8206de058165ad83b05d1c30ddbd
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14be64c1fe562cc4fa5b714b1ef42d912de445a252d71e95d068bf9651642f2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35dbb17f4408be5fd07f895646d5e3127b943a10173d532dd5a92642c44e17d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a02ee18396747f699f7366b30080bbc40d8edc8dbfea177740792236d059e1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0aea6ea480bbe3e63405bf85983a7b4fcac70726ec229634e6f64b146c63cf6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6168b245a7d950de593c68ef8052578d9b83c2452b6a1293bd5bee7bec3a93f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4147d7cef1453ca6389fb121844a20def97cc20da2c8e33f826c3bc5b7c42a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3fdfb2d37d11686e78fbda0f568438d8af6dcbb6f9dc3743dfe0567a01453e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 710675834b23c314d2ae4136cbac9fcd26410fcdd5bc61e08e8e88626a712933
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ce5bce7fe7b5199eea2a58e942638a9be06d444fc7170f7facdd10a1bcf51b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb4f5077a3d634e74fb50a04c526f2c3cdacf9e3082ea464107d768757cb171a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c951205ac9cd45b281198d77e9336adb28b69067a8a97db0f9f52a1f51e3dac8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0ebad5ba4910780c9cce3ee9bf01d0839e433c709baf7bbf45387d15cf274b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a4d8bf49adb2996c5682ef89688172ece5d97531b8915133c23d19e0ce623c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b950b353529f2d8865083923459f54c48237b9c7b6e6af664f1e4f1fe9c185e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97fdddecb6ead9417d14244200265ec5485b183ef6feebafb33d84849df2612d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2eef2b3df2bc9fb2a76f90e234ca1303e9bbc20ff0fbcad4740f2d1f25c9df2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a22e5f5dd5f4dd3549b733d45aa285d8d54d46d1dea681cf01c361cfc597a54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2ca1f24f08dbda936e1d47dd11f8d0df6e93dfcd4146894209ffca8809ca63c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c85246f46ad6d9c51acbf4ad7ab2800d5a476f45666911d510337ac031f2651d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d438367d2d989697103c47fd74d73948303a252ac86c43cb291ba238a40ff4b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e17a698ede3dd11bd692dc27ca056871a1ad2335ac9d550c124f6f0ebe31c50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09d80ed310ad6d1ac0cc3486d04870a51587396fba5fb0f86e08ad028b3c54dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70947790f4858688dabd7a6a71fef33ceae27d46128a8975a329c3489acb72a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a95704e442b8d0e519199ab22fadbca633693f9108658b88a4e5cff0440a404
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6b8422163a6291d245bf7229c54b249db669fecfcf917912eeecbfbcf6d5c6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1778ab730ac65029afaede964c642446746a7a96a7873d15f77641badf5df67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57edd84c4670f3902631c3233479155596a1eb2e9e81720423367f3ec0f0c0ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12ed7f021712a0ae907b9c3c762f9a03d875ee189c0c3184b714431bd13dd5b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ff64faf6ad6aef9af532ad44b5cfc8b7629b2f78ca11bbc6cabdf7a7ea00691
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea746f12321bfffeaec6a7b337354795c0e38378570dba9e989193552249cb5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94f2286b410b25b56d012046fa44af8921b2be259d69c4e9d9a060a9bebb741c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 895f404d5013e960ae1cc72f820f2ff0ae985b67caad77aeab3519474c7e0a46
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d1c192cb6f9c3ecdb534b64a6bb835b22dc300a8ff4e142e473feb2cbbd8199
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fff349d34639109f612ba9aa66ef716991045264a2c114bcdf908c029216536b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12bb22a99a69f60e6e954cf81568af50a43d0f2f7b9c6458caf9334967ee1944
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4f5897005d651840dff0fd86c231113d500a7ddd6387b1595e079e559eff3f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 255674618965f7cfd571fd05b84754d9bee3e62a95225f8b311f78fa5dcfbac6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5d9bf79efc40fe07d3747aab539dde545ef3a9255d6d8ac939810a10fd0a4e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fcfacdd9b0924024a3126f43445120d6c4d23fa584df22217a8ed7195f7f7d5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d58cbc0f7d724dd8a6768621e5e695c364c3c039187eef54a660b3fd22a77e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8251d5f9415449432105cc53e6016c25c907476b0b38edb6aea4a27a2ca92f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 688c50a4eeb33c92947e06d7d77394ab64ca2030ec4b3b99871d3e8493951725
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b3df4f2c740ab1bfc081e1c5e88e0f0c158818ac047c30ef89e0c8627460955
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2af8ad05b316a5ac8e501575a965f5ea3051e767696528e898b5826e14af227d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d491a0daa12683ea32c31b811a5a490e60073111003704e7a621572890221f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45d7012096e4e23aa7208fec462ea056c59e1ef879e6256af355329380378906
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c40989f59be4e98a84f22fcc1699eae1b4d172217bc026d6acd1dee4c6e327f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 000c12a0e681ff65446414ed40893174463e80d6b27ef9f0335059f6f9851870
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 861ffb5e913cfff08e1b5833116f74d998f128e3618681a81c9cc8fb8aa3b4e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a5052ed17eae976d7c2dbedc60b37930fff6f23282ab53387588e512c9e0796
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28d5bd6e545288c8596a42fcd23c99cae4d36f40e5b408b6a941d6b48cebbe3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a7f31e8ff889847975bc5dd824a0ea1a0f10d93627a7c0184d9b0430de83ec4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b8e6a392c719c168ce1bb20bca5705ca7826ba89ad0adb0457f9b2101d907c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 081785698d7c47087909f19de0584c673cee213f8ba7b28de69168fa84d782c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef489001957d128b57eb456d548827791a61d7775ee0331de666367cf7425441
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50bcdb02ab5bfbd1c59b68af7186890bb3ebd4b4fda9105903d5b4b0d0cbee6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffe18d272a8e92ec1a377efd9fd192eea040263e5b9e5e6488228bf2833c7ff2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1b7418eeb2e8b7eafc8811b93855ea24168e536dbe9b8c5dfbbe5ed62262aae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9741b273addfd084deb004658b2782f5153db531d85b34d4b93b287d8e7e394f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0ebba04baa00698acd6c960c6c8e8982390f3e85c1ff39e263442a5e7b7480d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e261c24074067fc61a3ac730fed6c4c86b023c9bab0486f83dd371c5d9e66f47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24088133be7782a325e71127813edecfb95412fd913a72f5f937944dd059e0ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 452b1840554c1206f9d30130dc392d8fc50c883722feeee360a1d238179f2c0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 394be1a8514678fe6d1ca79cb0789a4151817d75b1d3250b27118d4246ef1951
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fdbc09d9c22f0dff94b923b956665ca19d865dc33a9495e8b8d85d3ff2229283
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3414a255d7042dbf96bdcecd64767a61c1063fc1ba9ea2a3ce7ed4d692b5206
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b3c515b2d4c1447f5e5d818fde9f72c5b9b38740d3849e86ce31b45dc042db9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4891ec002cc081ce16eb08f783de0993de7991f87ef5deb81a0df436673d5d61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b69ec94d302c176d202d5c084dc4ca9093b075d3ff63134b462cb286792e0ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5968834825a11ce81437a40bd4e9db2b2517442d55883da7d28ce2da791b2a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b2755f8569450d3c8a352ab71d383c03cbacd2d8bf401a848f21c51ced20f3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9608e7c411c1464321c1ff0a983f9ec9f9579679e8e80cdf37b1360236ba695f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1db16fc1b60adabf90ce30dd665e9e0a49a7449d7df282f02e97e6fe29ec220b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7eafe4f4ed9e0e6a6d70d11162fed6140f537934331b4c4f3df349b03a944a2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a34a87c78f503911f4adca8c5c94b4df2cfde32a129a8ceda9c5701c1736e606
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee8e630567372875e23a4fd4a1e43fc55c16f0b4548900749b971c0896b40e4e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36cf5b8f3763e0cc52b455d0faa27e5d5cfcc2577685fcb07077eab0a40a5665
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fa94e7c227ac6bb89034efb35f47dfd7b73730be5a6a9257708450f02892b2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 060d031f0826b1ebaf2e0ccc0aaf490c637d446699b87789926498d88a248829
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ac0a5ca9b80114f2e8f02143c0a43a68f17231448b594fd2a36fd95e70f1d48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e769f439eb63e6f75a40459844b7c50fde92282944f0d15a5b990f94af0755e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d757a635ca5b62b94f8bf3f0a3f642aa708280e09e3dea861ad7cf8ff0ce05e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48d10ff17d8cf8e25cafca0acf2a6c9cecfa56594d5fadc11bcdc6d5da4100eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f9f4eaa46452cf1be95dc724f40eb83fc23030c09adf882c702c9bc4b6380e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fab40967842325bdda8dff7cf0e3a4585e448bfabde202777c01684c6f1843ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d9d54463b25a0648190b500e0404dfc0f0284cd71a8e88d3d95531816aeed73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 458b40e3bf35e0edd9c811f7451a9cee3a476ba59f06c37ca4013cd597551cfc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5adb75d7906e92b7bfad65110c77627e4a065fa357e230163a246ee040d2f027
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fdea8ebb3eb9e5d936dc2c0cd501c6704c706e7bf35fed3d2f48d7df521a5fcb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 715cc276790386a90209283f64e323bddbf0ea82e78c3a6973acd946db876e63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ad9b215808f15bf684f611d8d81797eaa4b1e5e6bb1e703f13bd324ad5346cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b3d80fa1f69097de8186547cad519b5ad2cf5f7dc8f7c3590e0dbf5b9787775
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c66ff0730f7d34dba4423647c019466dd4d58ebe48261bc262b1a6639536b73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb585f56d496c987e2ded2f6cc21993a8042dcbe6b1cd92599d43a60268baf05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95e471cebfa2670d2eaf88c452d291b843b42291d27837adef5a6cc10ddd2416
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c723f810319e265b38fb2a2566db5cb01af913fd4891cc74c911b5cd5b43096
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c42248d8342fbe3a4ebe2f407e5a671af098b9abcfd206b824c7864524faf81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f1a7b00a8db5b57f6c256f487e9d410d3b628332fd84522c79a4d9045e5b2d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb6b291576ce45b0bfd42386b528e9ca32468811e9f33d9bf19d599b53ca5f9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d85762551fee51d947c0952c9d6550d1bc0d03ec5416d077b2332f34f5ec1fbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd92addd62e0ad76e644613992b5ecfad84c61ab00f8c43ed3a81da65504d7da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0bb04cf3eaefa83398cf6095d7d587a09bff7086246519c4707420aea30d5b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a2839966d9a03a83e4b47b0c94f4e080035b2042bc6786570b1fa4517c48e04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf03516362b79dc86673cddaa504de380089a96b745f61dde7981c55d6d521fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d821c4043d1d3a36aebb2e8f3c0eb59ff59c19187ff42ed3917cd1a314c9ef3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4fe8c4dcb3f3a7919a86f5c7dec031b20edd1bd938ba82e4b15c926eeb0ff18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2531c6f3a31b00b41272d4e3bad58215fbac81a7faded45fc3e58e9bf1aece56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 011f7607340d3a924b4a36925778a2f5614d578c2a3567a663295b386c364cc4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e66be461d03757465487b6b9a2bc4752eaeaa536e4c63481a454718308eb5c6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c5b005f1b81e617b47bf3f0d2eabdb121130c89b1d9793d9c219bd0f137b511
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6561677bd34eafe9b3d28e3e47bcba95bb99239965aae1358ef6431178272e6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ff773745dbbdd8dd41c6b7f4ebfb3507ebacec03a087b5aa64a11a284f96a75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef6a55be0861745d5977fdf3f3bc91a8f31a30873e2e3bd167b16b8d0a42f47a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d511a98f0fcd93c5eee8a6b44ca23504fd055f870924559788b960ab4b0edf1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8aaebb096e5c5cb5a3a434069cc5c78c3d56e4604ad51c1a72173901ddc55234
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b1ff0473dd66462b615080c8d3fdc850705f44ab4a3df66242f5db6e0187051
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 838a4228bd38aec00a415f8c2d23ab4f42400a14dee3fd227afe1195af4c2264
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 712f3c59f20afa59d394e47fe2fcb25c23ac0b39b92824a293e4a0bb0ee9dace
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63cdd84065353b912297de7881bc629c1be061d3d28eae6a828f3b983281351f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b03c292e662916a3e22fc54632c318f6b124ef4f2a356e87458e32465f7dd598
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f88a07cceb8a9629ac96e6d923057b45c2cfb4c3f4466523a3da0f01cef52da9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16580c87b2ee9d2dc9d5868a7e85625743ac56c2c9476abdcc055986a26f427d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7520b4049b78266a1852c5fa48f5d4a64f2bde51ef544eb1d87fcf4acaadc039
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11b49619a50dfdf4fcc1f41ad2ea9e7b4adefe51ebe716b59cb5b7af8305a490
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cce99897cf745f651f43e80d9493b415e0281645cf6453fe97f91973ae83fc8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7be742e6e5d7bdb6dd23a9913a39f2ed988fa731e30d3f0c2fc699439e562f7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8cc9d91da52ca30825b337d41b23bb0ebe293332fca0dcaf9693eb75f27b6f3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b2fccc23a2b4f1a826c0335e594ad0fd7ddf62d0f9fa0a4d1e673bb59806650
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d84ec600e5f4f440db19eea8a2f24ae5e1637b4fa784686161b28b0ae5ad1683
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23752cfbf82d7af6b15a0b9b8a5c0d467cc9efbc58bc99f2f740ca5c0e4c15ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29097212caa94464bcea36ede093d1fe09a3fa40b56365dfaf258626259f35b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0b36bbb4fe56505f8a8b74ffc685807acac4e67a5415827ee9a3e074a9578a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61fa0e8b720c2130448eec5c146244ac990b51b5eff53b6bba41c2534f8db5bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13e564462e081ed4b847df7ff88d5cce81ecdce6e88eff5995054bec038ea9f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 359bb70d8fa4b52b1b20a37a1cccda2380254cd86c889ec3d6c9ed0cd1080b25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e01c958e1ec78d77f87aab6c275413bf98ad41ff82df2ec8f5f248cf242f6e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98dc1370fb4a6b780e3d3827018e390ccd1d892a29419093788aea8f5adc8765
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c6e145737c9ee5b3e8935fac531b0d327aca20de4e9aa634f7042dd16c6c4f6
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            cftmon.exe

            • Path C:\Windows\SysWOW64\cftmon.exe
            • Size 316KB
            • SHA256 5a7890ad2d6f9ddc00c9e9dda0a3cb3170330ffe911e75ac3cdf62913ef82cca
            • MD5 SHA1 SHA512 SSDEEP

            memory/228-14-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/228-4-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/228-6-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/228-7-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/228-144-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/228-10-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/228-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2216-167-0x0000000000400000-0x00000000004088A4-memory.dmp

            memory/2216-173-0x0000000000400000-0x00000000004088A4-memory.dmp

            memory/2964-76-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2964-16-0x00000000011F0000-0x00000000011F1000-memory.dmp

            memory/2964-15-0x0000000001130000-0x0000000001131000-memory.dmp

            memory/2964-843-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3612-142-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/3612-1300-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/4988-5-0x0000000000400000-0x00000000004088A4-memory.dmp

            memory/4988-0-0x0000000000400000-0x00000000004088A4-memory.dmp