Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/06/2024, 12:12

General

  • Target
    15f5d899e1d373b25e1fab2d2bbd6c89_JaffaCakes118.exe
  • Size 328KB
  • Sample240627-pc72natajj
  • SHA256 489b032caa858717255ba4f05cc09fb097daa034eeb24f9346e1f00640f12f56
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • veronicasexy.no-ip.biz:8080

Mutex
  • jajaja

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    update

  • install_file

    explorer.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3544
      • C:\Users\Admin\AppData\Local\Temp\15f5d899e1d373b25e1fab2d2bbd6c89_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\15f5d899e1d373b25e1fab2d2bbd6c89_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4328
        • C:\Users\Admin\AppData\Local\Temp\15f5d899e1d373b25e1fab2d2bbd6c89_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1588
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:1672
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:1040
            • C:\Windows\SysWOW64\update\explorer.exe
              "C:\Windows\system32\update\explorer.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:2856
              • C:\Windows\SysWOW64\update\explorer.exe
                6⤵
                • Executes dropped EXE
                PID:3056
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 564
                  7⤵
                  • Program crash
                  PID:4992
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3056 -ip 3056
      1⤵
        PID:3748

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 b0ee8979f9e71421285af10b913b6d4c44ae155d501568fbc91989a50ba8309d
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b516738d1c49ff33211a4a495e5eec89412fd6156e1803a021620647a1aa960f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb846413d96acde198052998a94453ec4adc78d995414935bac146141ab52711
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18697c048686790ddb59d14650968486958dec7bd4b95b991d1cba327bd89610
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22f7b29a230a7ef8534c485a3cb49aa1c2ed3632016c2d2512a9ceee0f5af926
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e32522e08604c84d44aaf692d914e78642697911b48918dd64c85c58446f65f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19a30fd2ec37846e3e8ee2135d271d4e15a5453163436877cdcd078daab1740a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9246a8f7ed820a2cf90d93db87a796e1c9f808921c0c289fbea6f2648819f9f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98a6270608777132af4d809f9c9ef3aed06ee5fba4c4f2cdc461507a94c46f1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8d96924ecc6082eaee9bab032864f8054ace36d385a2531822bfe06a411305b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b862a825144601d38fdf78d7ad469df40939a7d5a5350cad7b533148642a1cca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d97d6a5d86a752a1a5a6baef6319e292ec3bea2199ba69a9a929aa8aee31121a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6758f549b96ab86a294b1764f8f21ab3c8ced8d03e98673cdccf731e1219abd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8676c5486da729bc7d65875c10c5648588fecaf199240f7613e4a2ccfc0af031
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0893cefa4eaca3a4f5afeb19ed794d7f0140fa815e5462b52798a4b6f1476c04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f76e78efc8ef5d93025a3c9e45dcd5b2f29b9027ac3a05755e3baa7a6e9c28fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5990c2b13e3c5977d7c71a5831d9074e7b174f84463ea864c1ddbb70b61f229
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16c2faa23d081206c92718f237ec8367616320ff906fd0a3800cd3280b019cc3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eef71143ec57d3848eeaa0eccca5a372465ae52f926105861bcafc669e52422a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63b6068020e7f01596e4b7107e6e3fcbf8c13421711441aa5785393255753004
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5374aec3f34f18c176429a7cdf792ff3dbd0a21c84364053ea375ebcbc63c726
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd813514cd4b2281f205970cd8981cecd8bfd88d256d66160e238ae80f4b750b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e6245332fdc25b0d7ac5a0505ceec14bd072fed867d8123f13a5821763acc50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4c82afcbf8dd9fa2711dc238ebfa3e9695e872542ee3a971c178ad70591ab70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d04fca920fa57350e721163241be131442a831713133248e315bf31307af7f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 553718b2f47eae2012b01dd423ebca7ba424b1af07fdd88f360923a1f4e33b85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cfa934ce122f8c180ed322d0a226ce350357d4974629db84b7213810609ebf28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8c51a33fa35fcf358d702c8b40a1805044be0e71ace57d1e517686962a7e413
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c49a2015d82764444c06506f330e0d8195b3344cd5bb4917fa1c68194fce775a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc8a4adf3778f39f81dad51d5e157768e827e42b89ee95d5d96f3f2d7c8f822a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b90177730db8807d886cb11aa6c0796a99c4345c3914a0a991be24673742dda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4b5c062bdf33dccbea1dda4c269cb676547aaa81f176cc553f4861013c63820
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4121c293b05cff3cd543711ba4579376fac85f5e0f36c4a950600e27f307f90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5a44d157214c89199d90bff6cc534cf6ef945915012cd95932e30fde727381d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f851c82ae69661bc63e120d0517f89b3f54bc6a6efd88586b025eb1f44ac9e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37b24d96565a3abeebb3c4a7345b641872ab215d2133b8d100b4bb1720ee9f19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fc3bd9756097e49d8c68dc0309ad8ea57d2f7e7653ad58d15f98e77d26bbdf4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b17cf794307604e8d5f2e377f52df3111ec9be35fe20c2a36b2b77f783b8ba7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 120dc67c48a52f22b5bb21e7c8a4a30108636524b5425b4e9cfa94f26afcc6cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 895f855392ee60a4450024b059c858721072d346d2342b9229238f2a4e6cb765
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcb5b260fa4eb8969397a02c6c1f016855f816c91011220eaab18a11870ac61a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 972db9841c8d0c50c25a3a0d47d7f7e47ffcd03d5712814bd78d26a5a60024f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2f55464a9e523d2a29f120c9182eaeb6d16df11f6f6a26ee9ca4c23be1d375c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd41123da48919ad39668c7e19c1549cf8fcfe684b565d4074b1d0472dc909d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a332b8e7d940f30dbb95a965d7301764d147b212857620fe41ca8c55012a651
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddc3d9c0da0e25054c25736cad5fca60930002667051139114ccc6de410718a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f0acc3f5bfb71ccc77ea7fdecb0db30d1c2667ceedf9b9ee967010d72060e98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4053e4dbb7530c83401d53368e7ace9bd01326d04fb1cc85c088472022a62f03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc970c2568a30b7e7a2c9f370c9d2d5a660b57e4177014f03e045a09082c8d20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bad3bd27806862334e9d99f5b0506a9abe21c2fd486eacfd9d806c04c8dba079
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53fa7f3d10c964cb2a91035c6cd63517db706b248a1a19845aea68995811206d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 850ce1a48d8c423d46995c3c2f8fdff6512fff0d85f6900a80572cca0f246b75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0d43e342e08ace15e1f198f3c32d3e1367907539eeaa7b1430e1fc87038467a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15c0290bf5241391a58fd0b2cda5b662107a460fa92590c94885d6a6cc993a75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51dca3c4f663709f1fb673db6ad6f7d542d2850e446637b493ddf156dd577eeb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46fe3729289ce6500318014d8f091301be7c4c6f31ead08bd3416b43597bc433
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45ba72c3822a37cd4d734a8539fc857a827ab5461ae7531042f3e97c82a2417d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80459b57af54faab0d8ce3cd936b0a4cb4967a99dcf072cd15de60503dd527a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cf181ace464de36cea70946b19b752fa172e312eadf02554d8b930411a722f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 075b283c1880d28307b7bcd9b6b02a3f10e52cfefdd032e0ce0804db6d5e25e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d0a2e3b2db085105dffd3f7d13bc6ba032716d41f09ddf6fd97b26201eba242
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37b353a8aaec356ce55be13a7907131522e575db0d96a25ee826b217ccec1de0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9336edc6c154b14c6436e0d2833dd0e8d9ec2fdb665e71049bfb669740f1556c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6938809022d298d4568aa74bb2bcb85af315c111e7e09ae2ae7516bf94aa1a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94228a857b07791a1326741eef782ca68648e8d0553abfdba4a0d66fdf1a170d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95bb0ca8c9ebaa3456607040997f226bee28b354c5da6ea7f5b18ce573ad060f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6999fd68285600f0b9100d901d0b3b6eaa52f33800811c3fa0a58512b0154725
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7dc77e5d4d015cd046320c405e2291530f0ff5a3f9b15c659ea40e0397cb4a45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 475cb6e346a32b597f245fc6896f3561748ef8a9e83703c9097116ebe9dba60a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71b0f1d8e14f7057f6513c39e01e474946e32288eac5ec3069cb06c31798c879
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a65f5585826493f68a78f2df3ff305d406f1b1a14b2cce5b7f66e5487d4917fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60b56097943290095671600f9882fdbf2bec8155729e51971281c3d57492b3f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b29890d0fd42d2b23b0903c4c4361b07b075b4a664cb4e8bbe6ef798b5dc8138
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c42403bf236c38f1cc423e9db9c495ee55d99f8435174f1b6d5c207969add81c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12b0672cf8c3e60f9bfbde4e7a8c6bf4ba362c7c1ef22430c19da2470f7939aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb6873e1a8df4433eeecd4d41948252f63985f7641760a773042dc987e17a865
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1582f8fe0cbcfeb8b3a3e56b8757919180b82422c41df4c8e9765f24d549d4c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55614e44a5162f8f4b409ce49d64169ed7d5c2130301f8c2eb6c804882b82839
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a7269c03ff01dda24eb80b5f81b57330f73becb585e36d7438d424dc59a1138
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b23d147a41d09cf570ca0512d12c7714628c5ecbe64becd2c7c1dfed1c164fb3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7eccc77f00b0e90a78c01295d83482d4e8a0a91c140d1410fc5bb98a6a79c0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 705905ca6562b58401015d891d3acfdcd4f623e3813c48a291b7b3e8d418c5ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1eafaa92f59734403d8a45be97a762084c1ee44a8173ca468bacfa736ef0a3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec3922879095eec13f43299e1ed43baf44d466492b5591ab44d42dead3ef6f8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4043e54a10ad84ed4c4941cfbdaf15e2b928708f726101231e5e0186d66b563
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a971f1508c5d01ab66f8467c8a998aad4fd52c03a4657fc673b6b1909fc2b32e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dee6fd4f6fb2b8893182b315f860998e1a56a9400e6e07333120dcb7eefe6f9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64fb37a6e8a75085fbee787f1672022a15820c44db182a05d4097b03be199129
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35c1cceefdba19eb34e0377621477068916a8ffd63de9bf10772fe8f0222500a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52ee6aacec6108a61e813682985d43ff28057cec9c021df6b183d7dd6631e51f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec492453dc86d6b4bb3150a84349dbb408bb7341384abde25310132ed506d12d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36329e5c8cf9c074710386bd41e2eade46e135cbf15fa2e56c89e292deab375f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 534e9c8fc956c4880da666bcc170206baa3682335223ed9efa81b048aac182c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 592af013ba9ef6113c32942ebbd62a7e6acd784c5c2687f01b17567df6b2c703
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b0161d5583d7b0180fafbc6de5ce6ed40d0b5db80399bbc678e2b72a3d710be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3e00c50236d36b29475517302694e822ab83c561d007dd3af4c967188388a63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3039295eae27edb2323a3681a79a20621bc7f1c7cd9b7594a18423ea15471ed8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e263adaf2b9d53cb249f44daa3a261674a841f19548222af34e8ad282bfb025
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17732bc27a4343a67c11c2d659699baace449663b877c4820ee95266f231c010
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8cc1d5e9d58b1d04cf686b82ccc6e0d325e792a7ed58fbd7a952725407bc5477
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7120ba8ef7616ea7b3bef322b82b121019755d85401f2057af40bc90a7df6417
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5281b218f24154957822ecf931e5da13a895c051e1672c52e232afd80a5d2059
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f44121676e417167aaac4466d915c847355742a657bde5f8412b9bef755d035a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69fa4d0633517289aed2edd606a1df65ae48e69b73550ceacd8a4a7a1e390409
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89b23f06fcbbaa586e57abcc058a67f8ee2765965cecbcaf7cb840a422e00af6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47923e996ece1ea1cf549d30b1cfee7ee8195994eb35e81fc056d9f3185247bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68bc659592e27dfbb6ae514590c451f3f72f41a3ad187441dec957ebf554ae83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d0405c1f97417c9e8108cd2309fdad1708cc422a63589464da1df533c57f2b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc56c3311c87a5b09ab0f74399aa96cc6845956445560ea5aea46f15c1c133a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4f506f12973e35ab7a075f257257b0674023b8ca232f03f19ae6e2e1719f7f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 102c351c988b2cb5cfbec30847c0c1d9dc1c1899ae0368b5317221eb84575f4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a0b3b65488e5402f763d5c9b0f24e38896f4a6eb5ea6fd9cce08894e474282c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56cb8f27291aefd9f9ec419084fc99eb48012167d6a56bb2bd469ab8e1b062c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee69f8d8a1184e3744f26de03c1dc762d86cabeb5eee338540b87069122ac4ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b535294b36a15bc17e24f62cbbba57691e6b9e31a4403e12f251dda158a69d8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22654c0d3c2e2154d0bba9d16fd3a6c0a0a14436ed425102e6bc6ac0ac09ad7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3d9e38713aadfe60d91fbaea2d4b36ab48ef35d64971e11a6ebe62cf64c07b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3cd3639990fed4c516f8c3ec501cf4ca2baf1bdf5df102856cf068b09cedeedf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e2e842b1fb2aace90b248da7d7143a2a855046ba3566ac54dfbf8514a042521
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11a1aef7a0cefbaa2e036d8dda9be72bdf7dfb881f6d36d734c133c45699a30b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55f759e17a6807eb8b583460c5cbceb144acb73c29a4c18e6d9636e629644af6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7bd209102e29b7796cbf3d3f68de83a813190d4ceacf4d6572a59793be35edfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cac4127113e1fa7b4908a1aeeb9cb808b7fd68a9c9d73a16b9f05524ffdb7db8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 457ea23591efe506a6700d7ea85dd025ab712f3f283de7e5eec5197adebfaceb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 331876866d58b7c6076d32836a856ae6a1ec32e4d459122b53dcd5031433f219
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f345d7a63a9353d63a62c202101b38f8dccef87598e30bd1a9ca4f941e0c14f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3f934800814fd760bf8efc22216501f666de7a61669437273143d099c894672
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99c19077d7d236208311994784cd999857055f24f5c110a80b83e843ea9adbe7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abeb895e75f1ac18ff4e81d0b65c4758f54361ed9d34766978a2889ed9a992be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3f3e807bdefd488df810e3f96c4bf698c0a8eb529da497849c6fdc9903e6fe0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 007e20b84e8d6d1c85c5148607761abd08383ea226508995d4310aaf7594f4a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7f7d240b7c3b82abbcc53ce2313179c785fd055f095131a206d6b58b170c013
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a2a6c6de3f244a1a22c50c2eaa18d9158767006b97aa98f0a8ee6fad662fa4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 775632e6a22035df177de2cbc99f9b5ffea6d35b21699518b0850f25db4800f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 343ac75773ddaeb6d7d67497de03551ffc1ef6e7bcb3bfcf04bed734de7ddbfb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e43328187cd3abd4abf79c3f8b69d30922bc60d8bbe23f738a6cefd926469bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6a60f0fc5abbb98c3ae12ee14cd0ba180312f6b12e72d0a52b1024d7caf090a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0141fa960f91f233883d54a06fc1a6d1156c70090d70f7473038a4253c4fe0fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c16db31e4a31422388849a75ce4a5bf40a825e52cd2ac2721c01b3b709fe67d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6580e5c3fb635455ef0bcfd8bcee3ac3b980629c2a8dfe73ca999bbeedbec1c
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            explorer.exe

            • Path C:\Windows\SysWOW64\update\explorer.exe
            • Size 328KB
            • SHA256 489b032caa858717255ba4f05cc09fb097daa034eeb24f9346e1f00640f12f56
            • MD5 SHA1 SHA512 SSDEEP

            memory/1040-120-0x00000000002F0000-0x0000000000723000-memory.dmp

            memory/1588-4-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1588-2-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1588-5-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1588-6-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1588-10-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1588-13-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1588-143-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1672-60-0x00000000002F0000-0x0000000000723000-memory.dmp

            memory/1672-14-0x0000000000170000-0x0000000000171000-memory.dmp

            memory/1672-15-0x0000000000230000-0x0000000000231000-memory.dmp

            memory/3056-171-0x0000000000400000-0x0000000000457000-memory.dmp