Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    28/06/2024, 01:52

General

  • Target
    185c8d11c0611cae7c81f4458bf1adea_JaffaCakes118.exe
  • Size 408KB
  • Sample240628-cap2vavdja
  • SHA256 cfdd3a78a895b3f49a39402eb28b0d2134cc3086849a41a6fdfe7d829a0d4dcd
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • awrasx10.no-ip.biz:9999

Mutex
  • ***MUTEX2***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    sys

  • install_file

    msns.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    123654

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 5 IoCs
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1168
      • C:\Users\Admin\AppData\Local\Temp\185c8d11c0611cae7c81f4458bf1adea_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\185c8d11c0611cae7c81f4458bf1adea_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1616
        • C:\Users\Admin\AppData\Local\Temp\2.exe
          "C:\Users\Admin\AppData\Local\Temp\2.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3004
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:1716
          • C:\Users\Admin\AppData\Local\Temp\2.exe
            "C:\Users\Admin\AppData\Local\Temp\2.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:2696
            • C:\WINDOWS\SysWOW64\sys\msns.exe
              "C:\WINDOWS\system32\sys\msns.exe"
              5⤵
              • Executes dropped EXE
              PID:2316

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          XX--XX--XX.txt

          • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          • Size 229KB
          • SHA256 1125ee161d0cc272650155786495e4de333d3fb8c262f85a69b98744040a3340
          • MD5 SHA1 SHA512 SSDEEP

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 888dc7be8a89fb95be1a21ea26437edb80a3bfd911d65c5ca14ec8ccc4ac36aa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 24ebef6c5f2e1aa636473ebe1418e50c09d639781b1f14611a493eae37d7a3a8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c25cca13c61741abea64d8785fcd414af4b5f047754be1fc7a6c81b3ac65500e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6935a1b46c4a3e52370acbe08da029bc6fc48c3d0f01e968f550ff88beb3e064
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 77ae96deb1ef4a40d096bf7f158eb8396152837721941abe3ba66bcaeabd8b7a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 60a8227f0d2506bf4a4ce8f8ebcfbedab063c3dba52d830fa2cf357ae2745940
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0ecd76911430e32fc8b322e71be425df52167e4714f861eedf93eb51eff6a7a1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c8008313538e8fbe67c27406cb9dbd14f75f5aa92d9e183416c92f0b0d2f3cc2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e7f3d38337195e9d8f0812be7a79f9d1f6daa14d01388e2c05491e841d4a8a8a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7b5f10ca1e307670b1afd2f20cff6d227297c78dddbb6bc0591a191f8b8c35fa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 168f2d6c9f916cb856f51e1917da39dd7108a94c27ff86e3e415890f60009e60
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5021b9b195bfa683415c81da34825e21ebb83716ae40103f1c3fcdbf9a583d51
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0d443c53cdf9c479cf4e3c09f98f4a582ef2a4e08ec3bd83d3276314204cf53b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 890e7498fe36093978e507a64db8aee17ccb2130e07c9adceb3fb3d8c2307c6c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fbfc0d31e33f230155238ef35a8faf15f68fb54330a9bed33610e386a471af71
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 78851d1bb1d6594cb3ffdb55fba0c1e2d17476d48b8d1777dead6399884213e9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b6cdd3fa36940295347d57241bb96a79defef826c4c0b5b29521f67e6e884509
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fcc5a6d29606be13b37dd934f00dbfa1b4d2a58a53be6e025482631a39a09a32
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0845af68ea236471090f0d67acbdf39e3072042fd5456fc048de3c866856a638
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7f3f15816cbccf4bc93f7b016e91a229b073ffc40e7cc4d6079e8f0dbd02a8df
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c2808eef38b308cb9b4ab633c385c002ecf21c2a7315f555a751713c00cf2f52
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d35f82aedf0ed1e21b62a867578ef388954a48ccd235cef96e9fe84cc0c7ebb5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5547e4e8882468636ff9c4614cbbf65f853c1c18a84060286ef2e7e7c517c5f0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3e0821bfb789797dce8d9459a420cffcb69bdce5922760da6b53657a031fe7ed
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6cdf6aa1ca0790023f129102a730e57f182590eb66035d9ec8507471283e78e0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b5f6bb72942f5b408abb1003483a1e7dace9be13cc8fbf2b6714d10fe9b51a85
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9f4afe330785f7e70527b8a373f72a2d0292ad08a37b1e9101f5faacb9306f41
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 41c7c0ac8f3d6ec7f65f90a9c4dac42e477bb428fd2b236c70405a031da34cf8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 87e09564810527efa2bb99e49be14c3fb970941c05595b0f710754e677ed83fa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 27af4aa4fdefe1faf07e8dfc0a8774b82d12d33389df0e9568a7b6a3aa68eb45
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1f2e26abe1e8a0dd074441d6bec71391f99bb9c0da401da3bfe096e6f54352d9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ad60953a0b4acf1f23d5e9b19ad64b8b003e07cdeea72fc4d16e2e33fafea5a2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7ee34d4e9acf2eed28b2989e57cdcfb96137b7e0c5bc990e1b72cf150938bb43
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3bb82cdcea15429e4542a0ee9d3020e7e6ffe27b863c6ef5783a24e14808efc2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3ada063e4459d25b3fa07f241eb48c793add447022e850f0b81dadff91de4a3b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a12736b6a84e197cd71b300609d37f0b5a64c394b36103501d4e8e3ac941146d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8568ff5ccb763ec4fcf3af2c959b1bba561694214abeeee4465f39a4bd06adff
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5e6dddecd4ac872d890f22efe21292c46a8abc4299ccf12311a60ab8c9392d19
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 474258c443cb2c539a639965b92d6f972b9802becd9ee1864b7c8c0af1ac3d76
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c882c6fc47c215c8183a6a407b03ce5b23eeab7cca1550b4462ad96c4ef6f3e2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 adb923c94481d16ae65de143bf53d8789995fa4a8988627ef7c776964caa6696
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ac171a5fbb87cbc7233ff6214ed9599656a3f22a193cd817c72d77c1eb4ab41c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bd14e4856deb3b012871059d3bf666a17bee5b804d6cf2c9207f35b09d5b9154
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f996a4e8c0685e09ca899543b99801ac341c09e206b3bbe3c8e8229a55823450
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b9eeed8c25ec1f91494e364a15f0290d3818db809c357440b359a9e27eb259a9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 769b71daf549d0063851cf3725e726dc97a1175f447deb33a9fe60f2d3959c3b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 141b77ae6313965d2cee2990221d42728d47159d8e17a62791f76a890552e781
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 29e9f20c66fb904949be8713e0f2c4e33d8b9ecfd5411b95b14f8b3e6cd86732
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 066ce8b49233192986d6a64b03d0afed5fe5823e4ab98b2af4e900173f67c437
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 67e223d031e5085a7e71ee27bb8393dc1c5f37513803fd79ae888dd60368e66e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a0379b59b95975068fa44a7b05c47c25a9d525fa777360edea6a15333ad5d2d6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7d679a9fa8f363071aea443998666b1182245473df540b6712d7c61681e0dc67
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f62f15761f7a0c6b86bb4bac8e2d448aac9e820f92bc4e926d8a7dcdca7366a2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7fdb7d650d50de262406e078092509c37cb0e131ede2ad7803683ba2da928d65
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0277c310e71fbf529b90f54380e245fa6d8b9b4ef329cf7b7184542ea42e2963
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 15a434f2e829527cfc274e83fb42c5a62059f62a0200cf05b9695b7834ebc6f5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 87a761d63aa993f06dc6b67b59e4d6b1b042bb46e7f1f6974aaa5a849da277a9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bc3828e3540abbc575028b98dfd921fecf0a79fcfe671fff6dd5ebc312ddba48
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4994faa28b592529747ea2685b3677f17788c2f7be2860e0f6232a650abdf82e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 809a944db10b8b8a035db2eadc25cf54f86fa4094dca586ce33e7b07af815b80
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 27ff1072b392932088f5a21f7a90c641089d6f977a567e1edc2e366c167efe13
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e3818dfbf1b127f093252bd347852d0d35cb0de2b8d44873adb444081c0c3e42
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 69127ce0ad398d201a0414e2db2142ceec184c1dfe8d96045c9c1a925b29e003
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 eacb988c06a1335a6399dde8bba8789308e4359861eab28ef03fec9902dbb2c2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6990b0ec979f9d3b82ddba8f6cc413eb770bb062356780525e7ca077e2ac4ce7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 82db888e585bff89db173b5f4b6a07c4195f48f8fedb048c2eba462f0f107824
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0bf034bb2e2c5d0002b7250015ce2c6a4546b05cc866ab00009292e4791c0e17
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bae44937b0349e94287ce915cb2a60c5702f428daa1637243e71ff4318f60b13
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b9b093d13c8f14c208898bb912897a699d6447c667a5cea89eefd53093e4a751
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f8803658839e9656b04639197c259e81e8b8a7e23b2155e9eeca3d22b1f9d705
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4e78e01cbd32d83bb464e283a5742d640880b7673ad4538ab9ab4e98d6de9baf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a1035be01de87ef541c8cd2839917392417ed9ee02f18c4388b0e36bf1112ca8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dc26146cc64432960a3531ce40591ef45e918c3b97f1b958a1ebad37c71d8f6e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ee4d7f5c14d6c71afb66d393b59b3f0c07f7224d9c5d72807491896ba72ac4e5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5dd3ffe64ad253266edca8ba9905fa3085d25246740d63c1f5dde1bb77f9fd24
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 53d256d1890505419436fd04970b3a96dce1dfaac63588d4ed91b749b025b5d2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2567c370cd444710d6d4e1c0436f46ae8b123593703bebe7e5e7b5b1daa78e5c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9f8cff9fa4a42b0f7715d144894e0cf509a23b28403801cecc82fc86b989900e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 af3b8306e5674d1c4708164a3c4e79036a2836a19ade82ae35d1a83c09b14cd8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 38d9846c357e12dd5b6ff89d58687add368f392965a88933633684774025984e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dc1b5af0101e13b21c6f9e5c1657c9f28c18158655c99af79145943bf2240826
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6325d12ba713eafbcbc96430299ac47d15fed33273b2a3a6f80f08211f6faa60
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 15a511437ce76626033d7e2aff2068499e2170f328c1441862835c89f2c99600
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5c7325f6b942666d0a94a6f3d2bbe1e1b80d4c52eacc2440096eb03066a60488
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dcb1c459bbd3f4dd8c8338fb69e2bf68c7a59f56f463a0969c6cde507f06b5d6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f819a3d2b9947336b92e4d19abc2310c7680a499fbb25620e52ce1e16f4bd332
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0e46cd0509e5257bc2786463d60f5ecd1e68bb48221b89a5a657eb8b00803db8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 104c34d3a5ea432bb3678f76094c322008f4c1a0fecfa1e2cec66f257b253f96
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 654102ed1735b2be8bc8a7e024ab48e42e85a6fdfca87c7035a85fa84b1e8e5a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d7ac784e7a933c40408ad82bf8e32aa140a9a1e06dabaa663506afcec6081a2c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 abc0d157695b7f36efdba9a0111922800b0a29fbbca643833844c90b52d87b2f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8c2d53b6fa9ffe9b63fd3162d9313d67d412f67913f4b7c1d2e252136d81f1b7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a0b30e6e456ef37c18e9857e0e081b6d27df9272be4ff63f3839fc6432fb68d0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bfb0a869358848137b2b64a78c7ef236cf1b3c04b850d98d1bf8304c72f19b91
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5831883ece66df99ce731fdd68a93d872b3f117b84c5eee629490fa555507cb8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6a51c7fa9820803d0da7e466558cd62ec6cb0820a0b9eed8c9e0d8b8a608504b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5cd0397ec05c504893ba9b94c710f77d44aaa4a05bbf4cf80480ed68b00cd1ca
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f7537f54d91def515d67bdb5c2841b855d328bf57bf12b3c2de06671b6ada22c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 43e994b0a2fd0dbd040811b0ca7c5e159028187b803280663efabfd4bd3c48e5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 87f6d0df5fdefacc2658aeb79eeb6034bf09b8e106273516b18265393611c086
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d204dcbed845a84631f869e40d1cd8947992e07f469ce1574dc246fd318bc2cf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2b51914e8ca9c23673f66cf1dca6ec6e8a39d02f05c48872439f4c647cccefbc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 03c3b564035c0acc811458c277e1d13be2e65b07b224b2c4f7396d0b414e7b99
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1b1c3ff34ab6d13bf9b5193e1af88b9e3755d5e429607a079e60025c8843a52a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dcf2a75d5c8d9c343632e69f50ee7cbe0196e3944cdb10490f354f7a36cdd09d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d0300d9a744733daf49710b54134c1ed57d33eafbfadb61b6513b024eb5fb48b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 82d3c67cb7548940b7264bf24f228b463cc8ae92e9f05a7a10534896b70278f4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7eef3e3fba57d4e81777022f4a7b87a6fb320689689fd782fd05e9f976bc5198
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 af5f8514f61f28a21b3b2c44007d481053f6a1bb2107dc901908f6c14efeaf64
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f2d7672eaefe8fe198123957f93a90b454962ce5d55bc3a82df2e5d32383277b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2a9d92edbaaa1e4522a03c05addd4545105e9ff87ba8be71549cac9c8e7bbad4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0ea157cb073388cb0410cae13223c199dc3494e7593f0a61ea945457834e7ad4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9b01d5757649e7659d4361ef50d056fea97edd2f5105ae0626339c1320813989
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0774d0beba54e6288682d83ab61486482bcaedbfd1a38ccd1a5e5f4714242655
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6be0712dbd170266119d3432da72531bb3b4b618aafde881dbcec17eb258bbff
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2e20f31147d72ab881eca402e064d0c6da1909c4bd8c7a8d6efecb3e14ee08c5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 39067813ba544d2612ef863603d342a4b2ce9fdfc4412c8f9fbcecb075200010
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2d72217be1f2b203ae6bceaea5f0b65f6a3ab832245b73c0cad136a9ba55dd18
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8bb9c6dd2001e3c3da9067223b4d1d802a0c638d21f4bcf98dd604ddeb80521d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1d5cf852a5255b2f60fb5b105cd8f86373963b1b7f4f203a8e776f946cf8724f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ce5549f2782e073f08bb15378f5f9605b84ece854bb2ed81f8c753b19049a153
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1b5336f80ca9f3c8af72380e09ea02b82b26583fa5edd163c00d8d21ebaf3328
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f1e785cd849e844fef2881fe819ffec48678e041a2983536fe88c126ab10c4e3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 270431affec5b4278535c4c6e56f478370acad2ea3749a98d7ce8b871fb34ba6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7e1ff0042035d031a24bd0c6964cc596c52a8cbd7e27d315c4a5494957c53969
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0d97eac79d31638bd63a4596ef26e7b22ffd1e6e67b790d2425ce360d3a614f4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d30b3a3eb892c802238d8dbc5f1b7b990cd61cdc1ecc20ead4df50263664b202
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1d8b3e601eb1612d87ef46370bf798020bd5e74b95c82947e50b8c8f4660e171
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4554a2a53ffb06922d180309ffadcd4a089692e9ea0a9959f2720d1159a03c3b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f3182cf11536b65a86b5c09fcd7955b744389951976ad27e3c09ea1d98af0f77
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a9661eaedbd20d1ac397bdc57a4e9d02e66b44b5171e795a33c6feb6d56357ca
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7fffc1804e58e3e65697f1c4c6d820a80c86233170caa0e1d1e04304a3429a96
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f70c88f40decee53b0e8f4faea5d3e66889324e513de8f311689775af44ecbdb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e84f6f1c156dbcd24ed5c0aa2b1f6191738d63fce78ebb69f7bc826c29e9ac64
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2b8373b391541e4dd7355766667d2d8f474d67414eac03521daad7c833a9d113
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 941b51c0cec45fc8788414ed252d6f5d7a76a9f1dd31014da0675b7582adce50
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b908e11cdcc5ca9b0c33c382ef636586602de4a34b849aeed819481d78f6603c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 67bd5b1cd580941d7233565504c888ca9c9e9c4454684f2bc58abf17bcb382cf
          • MD5 SHA1 SHA512

          logs.dat

          • Path C:\Users\Admin\AppData\Roaming\logs.dat
          • Size 15B
          • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
          • MD5 SHA1 SHA512

          2.exe

          • Path \Users\Admin\AppData\Local\Temp\2.exe
          • Size 272KB
          • SHA256 34c2eea632ab848f3ef92ddb273e3c01f92034fce1726d681330e11b50e12cf4
          • MD5 SHA1 SHA512 SSDEEP

          memory/1168-25-0x00000000025D0000-0x00000000025D1000-memory.dmp

          memory/1616-7-0x0000000000400000-0x0000000000466000-memory.dmp

          memory/1616-0-0x0000000000401000-0x0000000000403000-memory.dmp

          memory/1616-2-0x0000000000400000-0x0000000000466000-memory.dmp

          memory/1616-5-0x0000000000400000-0x0000000000466000-memory.dmp

          memory/1616-4-0x0000000000400000-0x0000000000466000-memory.dmp

          memory/1616-11-0x0000000002F20000-0x0000000002F75000-memory.dmp

          memory/1616-18-0x0000000000400000-0x0000000000466000-memory.dmp

          memory/1616-19-0x0000000002F20000-0x0000000002F75000-memory.dmp

          memory/1616-3-0x0000000000400000-0x0000000000466000-memory.dmp

          memory/1716-270-0x00000000001F0000-0x0000000000471000-memory.dmp

          memory/2316-927-0x0000000000400000-0x0000000000455000-memory.dmp

          memory/2316-925-0x0000000000400000-0x0000000000455000-memory.dmp

          memory/2696-1690-0x00000000056D0000-0x0000000005725000-memory.dmp

          memory/2696-899-0x0000000000400000-0x0000000000455000-memory.dmp

          memory/2696-921-0x00000000056D0000-0x0000000005725000-memory.dmp

          memory/2696-924-0x00000000056D0000-0x0000000005725000-memory.dmp

          memory/2696-1557-0x00000000056D0000-0x0000000005725000-memory.dmp

          memory/3004-898-0x0000000000400000-0x0000000000455000-memory.dmp

          memory/3004-24-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/3004-20-0x0000000000400000-0x0000000000455000-memory.dmp