Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/06/2024, 08:23

General

  • Target
    154f1c5c026647b8ff3441fcf3d1a625_JaffaCakes118.exe
  • Size 505KB
  • Sample240627-kaaads1ckd
  • SHA256 b8c8c7fd936b91c3df934784bb504310932dd5a0d913dd2095ffba97e795ec29
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • zerut.zapto.org:81

  • zerut.zapto.org:80

Mutex
  • 123

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    windows

  • install_file

    driver.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3512
      • C:\Users\Admin\AppData\Local\Temp\154f1c5c026647b8ff3441fcf3d1a625_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\154f1c5c026647b8ff3441fcf3d1a625_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4044
        • C:\Users\Admin\AppData\Local\Temp\154f1c5c026647b8ff3441fcf3d1a625_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\154f1c5c026647b8ff3441fcf3d1a625_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4404
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:3612
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:2216
            • C:\Users\Admin\AppData\Local\Temp\154f1c5c026647b8ff3441fcf3d1a625_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\154f1c5c026647b8ff3441fcf3d1a625_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:924
              • C:\Windows\SysWOW64\windows\driver.exe
                "C:\Windows\system32\windows\driver.exe"
                5⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious use of SetThreadContext
                • Suspicious use of SetWindowsHookEx
                PID:3284
                • C:\Windows\SysWOW64\windows\driver.exe
                  C:\Windows\SysWOW64\windows\driver.exe
                  6⤵
                  • Executes dropped EXE
                  PID:1840
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 580
                    7⤵
                    • Program crash
                    PID:4992
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1840 -ip 1840
        1⤵
          PID:2576

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 4ee18100591e93d1ac2318226366560f54007ff83277f2dd7214b02a2a1db335
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 352KB
              • SHA256 7c24564c9b26de60241c9abbc393e840f9ce57d0129290a5b77b646ffe836ef0
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9f442caf8ce534456f198dafb65419115e824fcb04e062fd3000ecddb21812f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94c47f1738a7554f222db292d148b828f0f21cbb69c2de06c481713f000c63b7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ac1c70c850b9e1eeabfb6aeac884b446cc9ca984855161ab6b46f591b569ece
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 88398d949665a9804c7460e08e24737bcdd121906d0435c90f39cc1fc72d996b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55cbb88694ded160fac1936fc071880a22570e4ce7c07625cb00cedeb9712922
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f60f46054557a6c0429b3dc0c29b842741beb49682c59911292d3dc0118e89f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b46306b8f5422ad0f29cd802bf53d9af30f4e716a514a3d4538bc914764cd105
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa929520e54a2c7df18d9a87d77ce11310b56cd4054bf7a6facd99aa23ce0799
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9eae49ed35b9bdd6d48fffa3870f654183b61eeaafa24accae6826c1ddd29794
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b25c31b31fda3499180d09592302c630cac603787903de1f521d9b68331b48a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13a5fcf37cf2e044fba7a20994b1d36b456c7a0f1ba8d634ca52858bb8b8e469
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e4c8b8ba178b803b1c11c66666891d0835cf44fc121e6e62e73938ab5f1205c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 918ff793f2c47990dc68c3b9f04cf9b421d0a9782f3e1f76e8b83c84cd9e95b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f5efb878b1128dce60b0a44dd25488d7e21038ac389ea7e7017bf4fc413eead
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7856270df6a507c1d78e0980d6d89c947db6f7b54dcf71dc75be4b942311a61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f698a1c3908fb6c5b0f5d72ddb4a14bba34b82b799ce7f8d7813bfcd5c2f63a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 93e86ff7b77fa12b7976ed6ccf4cb2985b19d2d37144effb361fa63de7e11d29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc2aa4156a3eba035cf15288565dcfc83e34d47c9317294f518b14eca1b253a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 24a13dab49dd6b8d4f286085c181a47a9898c44e5c7bf2a17662caf002a6c2c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf306bc9a5e47d9adc5cebb4b2006267eaac438dac9d443b5ecd766270b2aeb6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89fee42ac0960fc0a40b24ebfed295b0b6931e6726c00b9afdb90126029d9171
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce6c1a673c48e973e41158b70f6f0113a4679d429befae025659a293e6341c20
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98f51bf5cb806b39ac5ab4ee861519726046f0c23f05aa5553f7a2c59242606e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c0a35b08ab2a6977ff722d7c725a395f0b7ac5a8206a3a3e2ae73b877c2fb5e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8d196a05c7267295111f61c20b171f163f6b2d82f206b1ee658dc76f7402139
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb895c5bf2c7bc11ecc10fda1e568d4a2425f026e5a47971f60059dbf5374dd4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 00225574dac469e9b05ac63f412116a9457181e8f1d5b638775571c7abdd9e50
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e3dafe8fdb29f2b6552c8098f458899bcf6e0d13e815e084eb2ed7425dee4b43
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c72a96b0dcaaeb09d14e6f0e6857849c28b96d5799eb5ec32bd814e2df3f46d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7fd7bd3f0c2467333eed738359d02287130327c39fc6089ea5abe7be7cacfca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d20ddee205f2eb01279ea6c60300f91aba9c552324d6e2ff28cb2feb583703c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f5236d6772d4310134cd96365fda3428579a0bb7fdccda79f755c89c04715be
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9bfca2a668c82bfb6c5118d53259f562253a99598f6f5f1d2328af04e5121f83
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ac0ef7fa216d25a224638ac461ba042f3ddb72ce0bfb425d64d4a0a6ce901c40
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9f9fa7d48d38ab5c7e5c2889a721da480f18181e5e22af2028b49582c87aabb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1122550b2df3636f72016930f6b808e36e6d2cef2d3238769b86c748e0b9f623
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5584a03500bf491ab0bc5de97ba10acb8827d240641d10eaf41dac978f0e5023
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d570d7722cd3cd0c041bc36a9c808d781d7c8c9301c87e41b5d30de73adc81b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c2ae1f3fa8899d798faf38cfc0dbf76e6973b16bdc6c3a9f2b3114caff29de8b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aebfc297e9b627e642f569647b3502d41b2ea3412ac1c9268b4d9b7fb43bef99
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8fd7bbb7cff69903f7692140bf630088039b76c5d205011c25b2460f7878b6b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92f52f9c997ccc25bf396b49534564ab1c3ef0e469c854d2d64a8002f3e05e5b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 759019529650023d762421539e10a158fbf42d0d2bac2740e840548d3d31972f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c74545a562d0205b6b8328490bca49a373d6749a18e82a1d70418250f623c74
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60c27c3fbe03f7477dc733ab8d115e253a9c34549d18fbf51e7fb353583a8774
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe49c322e0e5199236e082124b465db5b1d2b0a691e4f000374705710ed347de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2180216105fd461b97ae8c5c35ae9f856a1ebc2e2727d0d05a4631fbc221d67e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 970ca5ebb8d5bbae8aeb1a8c3a19754b06fec3ee54abecab66f3152d5b4410ec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 450ab7aa16032f4c5f8ba0076aaed590da6b7d2a6765413015c2070214531a78
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 79931bed57f2877fe0732e1531d95fdebe04a67212ac6da4316e3411519e34a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 77c04258b1278ef9cb540f4db981262c7eb50cd3187664792c707a41b51879e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 26d38b875b621afaa78fbcecc76d30873032b58b586124d69d470d543f1548f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bc3c828aac35898a8f145727142dbd8ec4003337e0a4047ee9513a555b7dc962
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78817a6728412bea676b6ca738baf172b4a843a7ba7fdb6302a3f6209dd2f3c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e036ca34f06eb799da823b552abf486d42f9fc2fa2be20bce5fc6fe5a875c429
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba83af648baf6dcd4a04a57c80258b26b81c124f2f5276501d4c9ca8a661b849
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e68e11110bd3cc0b614ecc8d3d45580c66988892520eb0dad582598b619e200
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a60440704e0108b0d9b2ec31355171ca2526acbb3a78a677a50584a09c4173dc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13a9f0309f25c612fd5cd51979fdcf4b2e5aa81285e788430929bb39a77c7b35
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d13dbc0b02c0f0ac94def0864fb85b5eecf35d05fbc86d488bab21ef227d8b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d67babd22600a8d66bb66aabb0795638d592b2544101b364aba40c56e43be3bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 75429a3588ddecb518058f32e87168d897c16155e9f903a08af936675a9499e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c287dc418d6d488f6ba2670dbe94c4cbdf2dd8623b40b031e466dcd7cd76aa17
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 effdda17aca61fe0d8922fe02040cebd20eb902c9c37fd33968c08856b95cf71
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f8e3313157a25373cf5c5cfa01e4781b1832f66928ec0c370170a4e6f7d873e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25aafdf75e5b0b378cefc0c07bdeb5d90afe3d031e948cd33f4b130f81ddb63d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6adb711dd714fd9ce69ce360c42543a64f7ff2813f31ba097607e910201a9f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8b452b6d7d61bd90b46dc9ae8ba995bb4c2c9d5ed0370de7c182d4996d4b3e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0cd8fc72d59539129be44942afc8a3659b89880ad091fc9ee5ab461023f34ff2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d0c82973a7b25baa1610252679f87f509df205fc847ab64919ebcd7a2be1994
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e251cd14310e74b5d61d109dbf3a9fb2065c8af19cfb458cc96bc4eae93e4e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc9f6346840942956636ece184bf8028da2b0e77710646d01298b8f75d1e2a85
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b76845539fc7928ca0b255a36aa9de997f2cc814406e42e71e966f7c8fe077e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7bd4f62e6c8e585a01397b902212a1e3a1258a958af6984932dfd06d88e949c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c350224f1688e4e0aadf7e84e8e7aa9c1bf607fab8e3464ff673bd0c72e11d7c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c7c3230079a1e3964a9a3298449a82cc16934d6e34386c5794ed83b79bd5cf3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe76517f5fb44c575d0fea30226fe7c05bb2690450c9885449b2f34fa0c7edb1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7359a1c702e993059f410b41d33f8d880274c303379f9a2f20a8d90453824dc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83da60ef4875b2e9de82a89547aff7e02119b7784fc46d193e0a33227af2f1c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5d5fd8aa8ff3dc6a568f723394ac3159f9d7ad4bfb11d536825c42b15ee411f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8355a5cdad9746383fb64f02ddbdeb846bda43850283a2837c649c4ed0463560
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad5c0bc40bd6c58a4fe1c3f5fda8b53ad603ac797b617242f9a35c3ed6970a1f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e30a3da6e8cf3038bc1ab8fe01b19fe017338708fe73ba409e690b7e1271ea8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd18a673dfe7199f52f07b87b6e38e881a7371e9e76ff64de4ec056cef154478
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a920a979be55fd22842ac2fb13fe336a35f137cbe8fefe842604990f784de4be
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a3b908ec95f12ce7890d0dd78735f88223d157fabf00722685cd051e43c1e8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 39d8f475dd62eef94012fb4be3077379f23de7369149f7c737987db7fbf909c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 05541e67cdded5461489d33a5e29b7a92ff444191f733afff62bf2b0f3d09a60
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e95adffd54d728fd94d2072c1e1a9503b7cb34c21ff0049a525eb7346377172
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71dabf885c92bb61fd46c9780289f93e418742fc6e6f0e86629cf2d1fb46566f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2cf93f6c1a8e3bfae024dfea58624192baf7d38af0419f8df860dd0ee94d73d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f2efa5a54343983a2f3c8a6e85b3fecc623a3e35c5239f303f628546941f4b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01f98469cf15b5fa50507c765a5280c27c08585c3c1a290e75c89c482d2c4c28
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d6844c0e9235b57cc6ee27f5f66e229984fb7c17e4faaa238dde5a31ef35633
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 553eae0cd0e4ce2075d8484715a3b0273d7f728eb3bace8ebd344f624388f08f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1aa83931848bd15b5a89eb60310c17d362e507df8ea9cfb9c16b3852531b4ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b045528ec2fb0e66c8e5100937d4d919400d1e377aa48eb19e3bf288944d7e05
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1456e10b36661781a8e85deea6cbf06761ca0700ec2974e2d44a908f6b36f23
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4549bdf420c9f64bbbdb013c48ffad1e20fd928689e17e6d2c59b8ff4ff424d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1660b86c9e635ec2252d9be747c7c6852d1296c5e4869a7daabef4be34127c23
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 894dea2e0e0d84ac0bbe04ffb97a7e1045e721d1d9c21592fa86fa95d1b9f4a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b768ff28b5ffdae75282452540cd4f9310f4c1edd060a903e6b13feeedab0f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e329dba899bdaf5e5fa1e87706c3cc22a77aae13954d70e50e4aaf95be1f275d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9c90ffffeff9e56f1bfecbe535bdced870f6667cac14b0774ae36f5c5db223a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2c08053134fc15eb7f13137236c30fc2169de895ef06e4c934529df6714b50cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b15c8ad2d2a3c768cc12690b9c4cce3f7afef4815892679594f416866b89390
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f3c96dfe078f5ba2a8db1f8373da47af77aa60d2dba088b3f1cced3eaefd4219
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a95268d38da01b75cbc1676c96aece6fadad1a340bfe5eed3293f9f566181cce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b604989438fff4e9987004f84dba5f6a7b6807e05930fee7b83348a87edf636f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5cdde88aab38fd39c435304efaee916402d6e44a4ac3ac07587f6ed4537f24ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 438698489461ab0c3b3de22492ec227beb4108a8212ff2f51d77dec803b1f3bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d28631cd1c3b28c01f3e18c22a0ba91bdeb2d78c3693542938c548767c834ff2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 99ab1fcafc553f2bf05c3fafaca09d3c5845a98edd1a4cf19a6331fcf559ab82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d108b31b6b41aee94720670d9d8eb6185ed59053fdcb69d1de8553306d2f74f4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cbb2ebeb8dee4f4edea7f5aac3b62ae1f32d870d1e17d0bc601ccd6682535123
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d439fbd5807a076bcc82b30b063ea67476f6310b9ce4852cdd7856d635586e8e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0efb1c237d9f8d2ce4aa2e71ab99489229e74aeb7390cc2e8a0c9b818fc3ac3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 75f3866a9eb71e7781d987b0b992077d6e46dd8d16b8d8b8e221fdda7fa46d33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0720652e8aa8647d289b49fde6418ec4860943b727020ab01a2a89b4d2454013
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 867b759e7bf6a60cdd228a7ec711b032edff672202525e13431913e7d14dc202
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c378dfa42f2c488ecfb30e3681fef997a8003d89c6bae79c214c6be9bf402b62
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98142b96422cf0cf3dff8ec30142cd28ebd56a37b9a4a18091af63163baa9545
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ffb62d34bd25e6e1bfcb70484d22cb27c334d67da88125e4f0d679e607f616d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36f44184f18f283536cc955cc80f72d90482490fe36ecded9bf0e128192d742a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63e792096f9c109c52bee585d4b9094fc1c29f3f58b618e8d1078153fcf9c7ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e09298163ed2d60a83bf315c9921d948565b5b68ffed9bbcbf8df917da619645
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a0576631dc91a74cd278ac4a9e3ec5209f42ebdab1a2cae66fd0bf8f2bbff6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 190189225e49c585c241e569e3d56310284e4c54d212d7daf9696925c05a5334
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b556aadb8921d074426c59bc320bd671a8fc32e940b0b50e7955043444191c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c406c11e283bf8544580f6402cfaa5d8567f05d3a7aa54d755f7421d3b1f5f05
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f3ed31ca0301c07b0d8c977f3644b8f18e525ecb9e2f519483dfc3bb3f7c0fd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a77703c715bab496ecf3954e412cc2454e247864f51724ff87c4a9e25b44f72
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b13ce8c1d8ab58553c74833e325790981b7e59acfa1ce128a38849473e1b5fc3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5fb469384729ab8740e2b28ac3d2df0e00ecaa0dd2bbca8525338ea3f4d615b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16b3ba85033eeb1b70ccea227c30477ac053c2ef56b07c38781fa4b8acf8fb58
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 725fbe66cb3b04e5994646111fe377512561b425b0da0f251e935cbc0e562fe2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1cd62a2f53e043e1e4252b59b2ffda0a33d0da7b8b101a7b277d5d0215ac072
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d08df39a8bace270cee0d2da0cddeca41af15ff59ef037539feb6bbbef7c992
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25893caca70f39048962adf56923b27d4583c764d149f3c981a6a67832542791
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              driver.exe

              • Path C:\Windows\SysWOW64\windows\driver.exe
              • Size 505KB
              • SHA256 b8c8c7fd936b91c3df934784bb504310932dd5a0d913dd2095ffba97e795ec29
              • MD5 SHA1 SHA512 SSDEEP

              memory/924-146-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/924-1489-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3612-13-0x0000000000F80000-0x0000000000F81000-memory.dmp

              memory/3612-61-0x0000000000140000-0x0000000000573000-memory.dmp

              memory/3612-14-0x0000000001240000-0x0000000001241000-memory.dmp

              memory/4404-4-0x0000000000400000-0x000000000046E000-memory.dmp

              memory/4404-12-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4404-9-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/4404-8-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/4404-5-0x0000000000400000-0x000000000046E000-memory.dmp

              memory/4404-145-0x0000000000400000-0x000000000046E000-memory.dmp

              memory/4404-2-0x0000000000400000-0x000000000046E000-memory.dmp

              memory/4404-3-0x0000000000400000-0x000000000046E000-memory.dmp