Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/06/2024, 03:29

General

  • Target
    14857a491712ef35206d507bde158ba4_JaffaCakes118.exe
  • Size 492KB
  • Sample240627-d2dzbszfla
  • SHA256 286eb7830f4b38c296e6c1363577508f6aa5b8b43f90c66f0aa192ac51e4d93a
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • pssst.servemp3.com:62616

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    system

  • install_file

    explore.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    123

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3448
      • C:\Users\Admin\AppData\Local\Temp\14857a491712ef35206d507bde158ba4_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\14857a491712ef35206d507bde158ba4_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3304
        • C:\Users\Admin\AppData\Local\Temp\14857a491712ef35206d507bde158ba4_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\14857a491712ef35206d507bde158ba4_JaffaCakes118.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4520
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:2052
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:748
            • C:\Users\Admin\AppData\Local\Temp\14857a491712ef35206d507bde158ba4_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\14857a491712ef35206d507bde158ba4_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:2408
              • C:\Windows\SysWOW64\system\explore.exe
                "C:\Windows\system32\system\explore.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of SetWindowsHookEx
                PID:1660
                • C:\Windows\SysWOW64\system\explore.exe
                  "C:\Windows\SysWOW64\system\explore.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:3980
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 564
                    7⤵
                    • Program crash
                    PID:372
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3980 -ip 3980
        1⤵
          PID:2832

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 7c9d7960c58384d77a8ae66f48c6f0fd7dc84862e357cdfd9c4c878f8e70d6e2
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 7ff9e108894db3eeb602927d5e6ce580f3f1a039ad68c6e44a4558f1f6b87516
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a55c49fc938e5725d9ab13230776e16aec38641a5b58459175b76eca717f0ec8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8489817fedf6ccffd9b40fb594770c909aa14aaeaf978af440aeb267b35f1a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f49bdfc3f5044d561ee42bf35b2b9c235fd5d534d8f81edea37f0206bcce211e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c56a23d669f535b4321b5f7ec328678c197841c3ce494a543a9dccdee74f20c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6ec35b61d4c743e1fdd2e073f03e7afe23488b6b847c4c5787b69de2c4231af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5b04c1fb77fa00bb91d0ae6cb278e9bef013c05ccb171628289cd5676230c6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ded9c7194d22162c59840f9b668a9b1b7eec07cee33c5fce6b3951907dd02590
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 008de4a9615c5e43ff99f353197bc505d2a0f7b5336cbe0ea3d3004b5633afa4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f4616d4064eb3c912de3338033a1f94ef49574773e358301257ec5fe3b40187
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7a1f8f3586cf0f10e4b778f37d4b3115c901febf141fe2a21dd7292248ffa32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eee2d76caeb22e89bb3d5ac5519f1092fe119525ceb0d19c36034f54046794f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 efdbbf4e952835e7fa4167c25c49fff61a34a3a52c68e084159554a55d72aa4c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54f9e7af643f5c11182a69b986cc4a39b72a12eb2237ac07a7dc9d2087e9dc96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8062a4e0cbceebdd52b1d22f3f1ab4240caa6b002d35ec386b5dcb26fc52a76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce8a1d036758cab355987750e44eef36283d49a297c5844ccce4cd67225c101d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 27e9b246a972dd0e774250d80a72f4d90a5b0638da42fc33b116ce4a6fa89e01
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3158a9defffcab6708fb83f125cc9beee42bfd5a65af6b7859e1567e6e099eb6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3619859287c543d125cc638b3909a42936fe4ad793bfe274e0a599c02ca6fcfb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe197c7a85651234998b22d3b00438247f00169858048f48439c65bb3d9289ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 20408b98d60cfe2c52dc78f2eea0a96c1e17226af81c994aaa376f0f3dc4d0b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 365c469a44112d78b3aaee4ac6f2fde9b6c899406c38731f5b2845b813106b8c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6fb6b256f6a120ef83dc3ae3512534b11a2e3b308807919d67d52fc608902d86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b83b512714587260cd6d418bb0f76c024f73abb5b603c283546014972a41c251
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60cb15afcac28964aabd96f2a7ebbdc261d83e1de5ef47913d7e4da0fefe1dfb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a82fb1edd9ba679b53f2390c11aaabbbce196065c5547f2ee882d612fc2e629f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89ff51fd88362357ccfaddaf0dae40cc5f2ad86f1ca9a06237d1990492f524e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98e343d06a06bc9e7a418eefba58d2338e50166f89476f8a8a1cad2a3a8500ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65d1dde53ed77f4a7a12a19cb5736f51c5719f3aaf87acd2ec304008b0ddc141
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4001d29525af10c45ee14a3d1997add2852d862b1c6ca6ffad63801cdf4699e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ad079c5a5abe66f001dc5c925805531a222b6c25e3d6f7f2a2591c992e3114a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58ee44df043808620c2856098a39cedc441e8ae7f05d7123a2a70cd30befffc5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9098353b1c4f3020279a3156565391a9577ba76da178266033259e8bd02e2887
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 318959b8af01b9679bdbe352382c2af198baea702e4febb4f7c783056113a885
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41520f6e60d171c0bb3269510202ff470f324d21fe2bcdc8a6f20431c2b092ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72f190ec41fa8d47b54765571dcaf53f167e0187967b82ceec73b6245be5f4fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 182172bf830cc660c94b7ad6b29fcf303aa9db0c466ad6d73ac9600c5bf7bcfd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 99c6336cf8ac065997a05c01ca1996aac11a3461edf78863651b4c2921c55f38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba2c453cbcbf5eaf63a761fd83945cf1a22b75a2cd30b66ffd4e39a6c884f349
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b59d59bf103379ac1e53f48f7970967b070231670f2d1677342f49bd0a5037d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d02c098ee10892f5a8a9536397dfc8e1853cdb63c34c97edff3c8e5105e99f3f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f91762317c141faea42f92e358c27ab9db0639d584001b2de3cd6d0e2706e48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d155f84bc12ab0dbbefd66fd4f4e3c4c98c85e2b13c17d5edc8cfbdb2d21ef5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 efb649b5bcdfe99d43e8d2a1a606b0ddf5c279ee1dc3ffe13dfc40457673c115
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 910e93cc84b3e2acae8f13ad682244743bc1cebe2be4fe04fbec8c5b55aabd40
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 523e5930a6cd5147e7db12411a5e393f99c9ef805045057645d0215c0478f988
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8e003a5047d3e444febf7f9a5c1c75f5b71c53776b9f20217a1017e8d7e105e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25622d467c8aba5fa4f0d419e94377e667a538e9119c4046b18b1bac7d3bf6a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 05d6d4aa190a50e75fa2594580b6ac625f34464afa8cf5760818f6c0b0ee802a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7bb88fc8be3f3f2ceaba7aab05e79d3e027d1f0603ec8277e59587b364b6c75
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4a3839adedc602074efa6b5e81933127c4e39fbdfb8bf6361ed305b2855f536
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fedf048a044af9ca4ee930510556912d1170afff603d466bbf427c73b3257bd9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83356a0cdbbe290949a04d6bcfd8cff38ea19db8ade49a3c263dfaca2b117828
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1cdad80552a0f92a0eeb1436ebd5d4d88f50cb853c6fd644309f3106bb9b34df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 82b594fc46eccbc2e5dd8ccab0423c4b79a3b934566188e0fc87bd035bfb3273
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08a85bf63053a83a9821a2ceca06330970af083e017c163cbeea54a978bd8d4c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf3a0238674d462abd2efb34054f0e2cd815e2196b7c1b195bc07cc297ab1aba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5f3b073df55d570d03ebb6f90fd0cb9534472740bd626c2bfeefa0643142378
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0cc95bc206f0c285686436655896a9b39f6121ffc298db54d55ffbb1f855572d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 490f0ce60caf94e255d6e5baa5b26dac4c62b17d50ce8c526bdf7f34256dc4d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 457cc3d9135ce044c77b5e6d2a9d219fe01c9f47376129c1fa43ddd02bfd21c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 29c44a7603d1de50ae9b042de825020279c236bbdd7469afb999f2c529188e6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d01176fef0d298d786e4f77e00027b5578010d4b1e3b7cba3ff1e9031be089a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb4f06219591e14a05f6baa265522112490548a0c005fc8b596dac5bc24e1484
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 721bbb74deb3251fdec631b65e8b620cb0e3e5717d37f8d87626cf1895a3d40b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2d6d016d9fa41153a0a602a57ffed984ed1d6b46cfcf37f74f3ec99b58dc342
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d61d30369e733d355042c9d75686d56cb31f60ef02106a552f004bd4e09b4fe1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 747e9840b00d61735ecae63ffe041d8236db6de63b7643ac7465c9c95084200a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 407a16be3fa2d79940219f0c77a3094d28d058e92037e337411c22ff58b40f87
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 02caf12dfecff9bb48e4e36328a13b1002102ae61baab3d20fcbc60a843c56b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9991db1124ef577a0204f8178767b57bf7052f7b217e177e9111b377339d5b69
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8fc87ed8b5d17e9bed390e922b983cf131636b26c02debdb26cc96180eefbdc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 863511e9dd93c9b13d888a92f33d2c03372fea09930e272276eefd8428b25e97
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b34eae2d1f43a084f5bc698602d6492c869beaecc2c79f2a78ae8c60f5e2849d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 70359b7aedee03af0d22c5e7adb519a16bbbbe682db71a35030e9948fbe874ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c2fc36b3b6f50a46944bcfd63313433b1a3e0de04b6722140f0ea643c8658ef5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 830fb56dc003e22f991074617e5ab6fcafd4d122271370e1a80dcb016d0e9095
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3864e01da3e8d2e01a887725dc03d05d975a18155167a15e882de6e4397dd024
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6efc23bd503df06ad8443c7f570cc106226e33af38aca0ba480103cbe663a786
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5fe198307dc4273aec9f4ed96dd06e0772794276a114a4ee9af76a0baef4693a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7776424ac153f728cac71030100ad351ca93cb560d18c0fc2a676372ab5c7ab1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 379e40a22c4ee481030b1f43aa6e82366920c48172ba75de681afc7fbbeffea7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73e344cf122eefc630c34c53c7e78ab614be28805e1f0c660516269f072188b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0a13d584d9ea4236330f1eb63be6aaba6faff18a8b0a092aaf30f2bdc2b6a76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f380dd7049d75f05e61ff7c3ef68b467dc2e7620f4f5e404bade370bc046e543
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7008ff8f8524ce7fcfacaee009e6a66db99bbbe1a216c8c190d2a88a469efae5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e05f9b43d2590dead4cdf878e9dadc068363d0af3760ed183ae82e8e75068c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec1ab53dc2f96cc06dc4ea0b8f04506fd8b33e8dcdbe499ee1e5ff737b1148f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2cfde3e2c6504cf015f12d109dc037648560667ea04370e6f27c2a4623749046
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc3031e3ff5ea7c628fe2c00f350ba9d8ade8510c8d317e9ad328a75d0c50d74
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60ba94eb06719e9acbd2a469801534b78c079eba78f20fceaacb1bec40433268
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f8a85bb5bf8e67e9e237dc3a513eca5fee79367def372035a79c1862bf3a118
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5088f99a14a0635f90b0fe966221b3dbe5e73d614789ab459e2a36c23bffa3e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 03487ff20e0b4e7d4409dd8b372062b796789a96ef26c07a60f751b01f4ca067
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1202c1ead685efa15e1e9fc9ef6b833e82133d86e2fe3daedf0c3662f69b86fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5083f53e9de751764cd0a6049fd822b29c826226f4b402092bf9d55302e20983
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1037dee8efcd58ae214f8321cd606705956b12a9e9d64479d2a9adaedac4d38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa5b7056669e00960dd544cbb7e16d39bdb0edd2664b17ec60fe213890f883bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9ab43e8757fbc77b17f28e5ce7c4377e2549fb6a4d663d347dd80e22a1074f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 608a803168e7164576c0c8bb99b04ab271afcef127e835adc27d885c857101d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1253a81fcb1b46e67f579de8103ec8c93c5ab4637a481b31445d5f0ce4a9581
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c7ab74bd139e96a530f7b0b55ca3abc852288d66f30b2e2db0ca79325e16224
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ee3235935d74b0d339eee9213560552dc4188600a23b7fbfd61c2611f895c65
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25dc226cf2975c8757dd6ccd11705c383c972c133c13c6a2bff9ad00c1aea680
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a84dbe0b897e65da087f16b3fd98ad8770f33a2c14677f907d6c8dfb4c90ec5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8aebdd39f17fe6afa5ca03d7659cfd596b77e254049b7e6dbfd39f8609d6bd64
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1926be106f6b3452ebb3db85f2c0306e447af119080af0f8c87a9f3ed8cb3d53
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4657b753d64cb97ee8f23911960e96a66afc869266968c11f33136615919b69a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5791dc494268c2ddfdbb00750b23a65093082c922c9ec76ee0b090d4a01abda
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7aca53346b7ecd9613d61da719bb945274695c29b059540f1fb82b1895ffb75
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8018d22526d2c7f370da873cb9a9bb074520df72ec980637e5b27c4ead634be
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c516f5e5fb75c8a664290bf2f1dc9d7ad5c41759e780516cf3e8bc5fdd57d5a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6820bb7a9cdc15b762bb8f0a98adaa73a392d5eb6f744df3202116a3c85ab6a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63a948256c59e3cbc1cee3c0205c6ba7f410ca54ee740345588340287229f1b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 74bfc82a4f081b140d8b80d37f80131b11e3438f25d245fe6e409cd2adf4fb81
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2984d372fb57e5b7e9d8a658d1b0246655c8b38e1d2f0be290e0a7ecdce363cf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 81bbb6e5a28cff1fd32d17be9fcf9f1a0e8377a8349d3adfd2b18e459c37c689
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46af0ff231941cd58f77ea0ae5e9ede6b0153dfd9a0fc923b2a98b526d5cc8f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf463277dfab2c51a7775f82ae89812263ead4587bb8a47af39250ee3b1b099b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1b5a5b9632a08e597b809214851839d4883b400532dfae22a371ecc951cffaa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af3d11edf158a043bc78321be1b05e4e84c0e371b0a3d01ce9d0290e98ed4bc3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 87e19cd7f82b99798e4a0df63bc418310b08ab4469fc67cdbb0419093c748de4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f607f156ff3123cfe244ae6f3e347d1429b560c1195d3cde6b7a8a6937b058e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b61c4e263a8e3efbb65881933b5fb3da3ce6d39380c24d45ba7659d4927753e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7263b088c0d8659973235201a3041795448eb94339cc2fdea4fb545090d2dec2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 406f5a9e1bef226183bc3521b544787bfb8859bffd8304e485406870b5838c39
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c8e3093fd31f46bfbbb782a0ebb8e0b82197cc8e353122a5fb8a56bbf525341f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 742575ae231e80b9cdcfc8f1b69e916aaf7e6d38c86d30a5a3e78b26764e14a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d1b148e06a997f69e52759134e530e0c3fad62cf4c3dc488b4839e9d524e249
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 012c73b175dc5e817cc73bbe0ead82fe6a302524aa46c2734e6a7b98bf05c883
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f71ef7c59f2601486ad768e6c5fa592e44773bb8144b18639511606356c6c605
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94a210f4e97307bba0ce05271d0bb03bf6d2c545e7c9f91776736c68ede56b7d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 084d94d48d16f81ae26d90f977c409d5f154a5ba45da9f57a314cb4d403c1b75
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2eeb34522283ef877be877f891f8cb4a32df1493636a32225be033cb7666c69d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0a2cff76ad28d5d851cd2361d4861278e2570048219cdf70c7a53a3c5a9527b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9da1a9c1a0f03b83578503fb8a27c9156a108e3e6460c023e9c70afce5beaf39
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d876ec58f5bb595ceec841e2e0a17f02a1e0b93099fab645d8fb11d191011ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c870249c6b07b50c84d2b0d5fa80125dd71fc2ee5e59704c6cefa5dcebec7e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 87fdd2231f31449012ae9eb5fcef21a9608fde75f51a701b0611e2e8d15a7328
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              explore.exe

              • Path C:\Windows\SysWOW64\system\explore.exe
              • Size 492KB
              • SHA256 286eb7830f4b38c296e6c1363577508f6aa5b8b43f90c66f0aa192ac51e4d93a
              • MD5 SHA1 SHA512 SSDEEP

              memory/1660-171-0x0000000000400000-0x0000000000568000-memory.dmp

              memory/1660-178-0x0000000000400000-0x0000000000568000-memory.dmp

              memory/2052-17-0x0000000000D40000-0x0000000000D41000-memory.dmp

              memory/2052-16-0x0000000000C80000-0x0000000000C81000-memory.dmp

              memory/2052-39-0x0000000000290000-0x00000000006C3000-memory.dmp

              memory/2408-147-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/2408-1294-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/2408-107-0x0000000000400000-0x0000000000568000-memory.dmp

              memory/3304-0-0x0000000000400000-0x0000000000568000-memory.dmp

              memory/3304-8-0x0000000000400000-0x0000000000568000-memory.dmp

              memory/4520-3-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/4520-5-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/4520-6-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/4520-4-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/4520-15-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4520-12-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/4520-149-0x0000000000400000-0x0000000000450000-memory.dmp