Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/07/2024, 04:07

General

  • Target
    2aece46ef18e61b85ccfe3f3065c023e_JaffaCakes118.exe
  • Size 598KB
  • Sample240708-eps36a1hkq
  • SHA256 b7c4c773ea8a7d25405d66e11da30d0c434e603df0f5a6d2685b8b01dcffb669
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • ÖÍíÉ

C2
  • sloohe.zapto.org:288

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    t?tulo da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3444
      • C:\Users\Admin\AppData\Local\Temp\2aece46ef18e61b85ccfe3f3065c023e_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\2aece46ef18e61b85ccfe3f3065c023e_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3392
        • C:\Users\Admin\AppData\Local\Temp\2aece46ef18e61b85ccfe3f3065c023e_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\2aece46ef18e61b85ccfe3f3065c023e_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4220
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:4804
          • C:\Users\Admin\AppData\Local\Temp\2aece46ef18e61b85ccfe3f3065c023e_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\2aece46ef18e61b85ccfe3f3065c023e_JaffaCakes118.exe"
            4⤵
            • Checks computer location settings
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:2564
            • C:\Windows\SysWOW64\windows.exe
              "C:\Windows\system32\windows.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:3160
              • C:\Windows\SysWOW64\windows.exe
                C:\Windows\SysWOW64\windows.exe
                6⤵
                • Executes dropped EXE
                PID:3172
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 564
                  7⤵
                  • Program crash
                  PID:1268
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3172 -ip 3172
      1⤵
        PID:1172

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 0b8e6a392c719c168ce1bb20bca5705ca7826ba89ad0adb0457f9b2101d907c1
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 d020deaca5c42120f188d3dbe96f10411f01caf4bc5f281e0ed469eda8b55dd0
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fab40967842325bdda8dff7cf0e3a4585e448bfabde202777c01684c6f1843ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ad9b215808f15bf684f611d8d81797eaa4b1e5e6bb1e703f13bd324ad5346cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28d5bd6e545288c8596a42fcd23c99cae4d36f40e5b408b6a941d6b48cebbe3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fdea8ebb3eb9e5d936dc2c0cd501c6704c706e7bf35fed3d2f48d7df521a5fcb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dfa29fbc212f88b3571302875e4102e71c76ec4c36dbc91498d3c39defe50d67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 452b1840554c1206f9d30130dc392d8fc50c883722feeee360a1d238179f2c0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 458b40e3bf35e0edd9c811f7451a9cee3a476ba59f06c37ca4013cd597551cfc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef489001957d128b57eb456d548827791a61d7775ee0331de666367cf7425441
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c66ff0730f7d34dba4423647c019466dd4d58ebe48261bc262b1a6639536b73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fdaed9c7f89005aa8437108897abd55d8c995c8b6ba9157118a2456f7a8bba53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b3c515b2d4c1447f5e5d818fde9f72c5b9b38740d3849e86ce31b45dc042db9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9741b273addfd084deb004658b2782f5153db531d85b34d4b93b287d8e7e394f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95e471cebfa2670d2eaf88c452d291b843b42291d27837adef5a6cc10ddd2416
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b23fceb0ca15142cae1d6a12b2e2ecfd4c31732e86dd9a6138abaeba3a7f7ba4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5968834825a11ce81437a40bd4e9db2b2517442d55883da7d28ce2da791b2a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 548aec13a169147536b7f73d3aef219937ffe764742b06f6d738c61abc9f2927
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61fa0e8b720c2130448eec5c146244ac990b51b5eff53b6bba41c2534f8db5bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13e564462e081ed4b847df7ff88d5cce81ecdce6e88eff5995054bec038ea9f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d757a635ca5b62b94f8bf3f0a3f642aa708280e09e3dea861ad7cf8ff0ce05e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 359bb70d8fa4b52b1b20a37a1cccda2380254cd86c889ec3d6c9ed0cd1080b25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e01c958e1ec78d77f87aab6c275413bf98ad41ff82df2ec8f5f248cf242f6e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d6c60c02650c5575fca4c338c4425c1d4ad8fef85d425e2fbe8a7da7ae5acf7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98dc1370fb4a6b780e3d3827018e390ccd1d892a29419093788aea8f5adc8765
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cac269b73013ba795e54a8ad241b4074882b2b7ff3b090063ed7079dd6bfb14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c6e145737c9ee5b3e8935fac531b0d327aca20de4e9aa634f7042dd16c6c4f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2709eec0714635415dd837808197b1fa4d4004a9319fa5a40fb0211a1b2d0e05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c42248d8342fbe3a4ebe2f407e5a671af098b9abcfd206b824c7864524faf81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9762c73c718a9701b3c18308e7d4282f55062ede6eb9b9d2d480d6a1ca9f4d7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7eafe4f4ed9e0e6a6d70d11162fed6140f537934331b4c4f3df349b03a944a2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd6bb3bc4e2229130f7091c192d2657237b963ce0e534d9412b2fec2fc769dfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36cf5b8f3763e0cc52b455d0faa27e5d5cfcc2577685fcb07077eab0a40a5665
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7853cefab7c7625b77a08181630b58942edff36e40a513297319d2c9ba256d37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ac0a5ca9b80114f2e8f02143c0a43a68f17231448b594fd2a36fd95e70f1d48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f92af833dc70ee73eaccab1862e1bf82bbfd31f95f84f72dbfc2ef9d773c4a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90c18498044d150792203301f2e9fb7a596733eba3afe414ee8fc0693d68a22a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e7abf34fbe21b459683675297cdcc35b9cab4e799dc956192967343c8542342
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72478bed011973a4c8759e285ade204940b125f278ebde565d49737e5e150b6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f1a7b00a8db5b57f6c256f487e9d410d3b628332fd84522c79a4d9045e5b2d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87fd615953f53becc57d58b15e2f32b1973e5aab180842cd636dee83efe7b3e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d85762551fee51d947c0952c9d6550d1bc0d03ec5416d077b2332f34f5ec1fbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 822eb5b10435a4d182646c578bac0cf0bf06436dba858ede58efd2c87ce9bc20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 255674618965f7cfd571fd05b84754d9bee3e62a95225f8b311f78fa5dcfbac6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ef8f32aaca8bf16118ccae973638537c4aaaee433607061f1d8109bfc2806c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bacb759e10813464983bb970ddaf9077ff7e3d468567a0f89e5cf87a687f514
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03b44a0d1be6d9a2d6d166aed2571f537c9098b73f08f35d004c928f6be57806
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c4a549c07a09db2f6611e36ef31c349bedccd36abf5fa97cfbdf3bf77e830e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5b690c5ddf4886cbe1a9b9c37e2833d599181dd326d7dded82dd28bec87a60d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50a187327beee4c66e24bf7b232e5d27747b0412b51777f78b727b6a4921f737
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8947de5566fd106579c4d977f0652c3f932194d31d4aa21350e5bdc1b1e2a8ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23598191f4f824dd2872144d0854641a85592a47db8e52afafa1e98deb8d478b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b26ade3de72c09b2ade63633818c9b5a263f3dd54c35267c7fb07bd84e60ab3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d410b7ca0d1eef7dc9a530d595e18cacaf32ad4ca8246853a543ae237284d73a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5de105f4ae7814bb2b01b553224d18d79c4ee98917b47f20ef164647dae807de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d42d3065bd3c1492d77051ffe39bf38d8386fcc36d9ec40ecb2015e2f4267a85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28fd22f61691cb1e7dc955c0de5d0bbad49558faf23cb2a9c21413818442743d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 222ded14c5268257ba83cb5895b6bc123c53af89edb61d879d5d757d3579d672
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ac0703d08a45017e57a1bb403ca521fc669bc072a9812d1261ba3fda176e30a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 670b86c1a5c116a51bf96214917562af258cf16eafe615e115999152bed5c079
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8b234e816cc0cdda5cb9470965f636477b23951faf7e5e43f1de6458c63c212
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83c366916849c368434992c54cf7725d715c228ca4bc358c5931766fec9f73a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bc7ba9e870e7496d03de24829eaa4d5ea09cb11e16e3697435cebd396064bbb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bc39a090bacb64d96c0d97ae0f781ce9dce500ebc047bc0f485f71688148cae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d40c8c9f36c618936eaf59bb74162b75555d83dbc7a0edb04916e388f4629d37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7287d0ede70708852cc14bb54a49e9806b69a6aab3a6cc89672f959904f8b21c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 936aff74cd72b3fe4593c8fff97659c0290606ff136c3b4fee4dd2fd2b6c99d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcabd82d7f90790556341c002ed2ee305712eb7f567ba1eab24099160ca63f3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72b9059707c6d63fc7d5314648a1ba16e15cd69ba7e6ff20d08588a92b6519d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a3f369c1002e86fb22eb132e9a4d7b9b3107ef722f861bdfbea6070d95ff6d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64266deada72e132e333b0fb8f30976a592a388cf12231a5b263c9ae1a3d7e02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3bab7029b2c004a436e4f9cea0d8eddfdd4d981d626ef055d0bae03eaf54ee8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5feb1ce6bf28f6dc4b6a0155624ba89c93cba4d2ccc5323eb4958c1067695c85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4f53ab2c6b1cd3c26c18e2bce9e610248ceda286369c1496600d56f9445825f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4655d0f1fbc567b06927b18b873d119bb5e1c6dfc8be8f2e108b600e91f7f7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9329dd66fde0c0e15c8238f51bedffdfa523e728d157bf91915054f88942127a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b4849be274a193dec5035ef641920ed00fb4e897a294c1c2978192ac00fbbce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fde38cc81c09bef784ba871f1df5f6f6d6637fe68e7eeaf926a1d63ca38de419
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b89a714cae8813c0ee4d11670d987d679dcef8bf36972ee4052d56b3b59a5570
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 780c334e81b9f11e9ae802427aeb7faacc85ce1a96df05757f5404feab18321a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b454287c061ad825bcae18765d147eb99dec52666e55c81eff9316b73782f8f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f04f49715d34ec6d8a690dfa7ff5395b7a8a81caddfaccc15928b74186385814
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa933b534162ecd4ce8bfcbbec044c06514d2da70bc6a38262733f4438e74aa2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 502a4f6d9ebfcc15c0ec5c4ead12db75b27ed7eec533c700ebc7b43b4aebf78c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7724c859237637517e99585642c54be09fb75cda14e0042bae0dba9f38c4759f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78ffc1b50604042acb8e40a3cdeeb0eb4465768ee0803dcb7c9739328d40898f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5dd05f9685ee3ec77a22d056c1773f55b38949b04255b18ce9a17455ed7db8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce0f30e19630e808f4c2c02d45f50fdd0a5e1baf00722743cf655b3251a2fcb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 010b30d9329f46cbd30e684cfb7782caa1d41d68a15531ae8884dad330080525
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6fe1de2c52ecf247ada4e9147fd2039ef6d808bcfe854b7e19ebadaa2956e87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a844d57d3ea2463c0bda7ceddbd7eb117d0e38eadea17359fc6b3903b4b302d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ea4b1f2053c3e3a2e3fffccf26ee784bcb204affb1d52fe9ee69b91884823af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9ce19984bcec6078c66ecaaa710673051cc8c4671548eb3dc0885b8e917f5d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f5cc8b1ae74a1d25503e5a49042511b744a4b0b16017fd773cdb4a1fa3c1763
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02794605b89d233748f7d3f14799a551da7461664532ac729436f0e630373e7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fab4e62c2978bb4d2f924d3e1147903d91f0b987a69c5995735aac3f3d39cffd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 433e53e263a84eaf0453c450be1be3c2bae0d149489582eb84bef64ec1c2879e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 948f9d9a01778c82c6f8487f5cea1b7897f228f0f3c84a5ce862f9c46fee2a7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc0f56755a1cc2907c5f8eb7fa3e9e3af6761cd24cfc00c9648176b97adb3725
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ef5651b372b856d3d6dc9c5778885f8f823014ddfb2250948f3404ea1c13ac2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2584328369b7e907b7606bbebb7fb0b6558c7a43649cdb6452e71b0076a0f79f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc9c0fe705c764ce3df67ef18834c8884d2623efae6c558d8a98d2abd6770549
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c82550ffbab7f470738d793e198618a5fc0ecf546c3059d7c5d2dd4eb1adf7a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f7f7b4e73bb63d1cd4f414f74a9936b7dc9ca7373db11b8c1c835022656db0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ce56b5c034c94d2fdb831d862708606a4ac0ed94d8b8ccdb5fd5118bfaf4154
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61f73d2683e05da23c52395dec85c96635df423f6dc1520fb225fae1a2979bcd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c99e6710a4c9fe12211765c2a0b612e02a924c09dd8cd9d80221ffcda343a3d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c77fe6003c277da521af7db13dc3fb519a4dce7c9727c6dd51c0d61d90b8a44d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e3e2f13d355ef4f998e4d060165525017349610b5f604ead655ab7bb2f0a803
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f6b3f48a935c405371e763abc84568b43101f64b0b36c04804818d25b454b9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fdc33d5803d03a75be5e03ec2d06c8e40aa7d169e5a8513f5aed868ae8aee3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d88f4c14ba8fc6b751d733c18f80ede82b9516e1318a53d1e1d00b24d9f7d4a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f465c870971cd67e7509635cdc11311896afdf54836ee760a30511932cc87f44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a09e280c6ed5be31f747a8717b5e80bc88041fdf27564b96232bbf52bab851a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d4a98dc98afb4f7f8ca506bea75c018ef71462f44c14c6d9db9bd798d1fb102
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 923a71350676aecf74ac669ee0824d62d29925022b10724c19e80d67b8678ebc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c1e99f5d660e7cd98287fc999c17da8088ecc0cccda81fcad6d86a664b0cc0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b02fe6d67c65de014d1c9fe3ea0be2f177b8e73fdcdf846d5c373d38fdecc16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1aeb58145e5828705b50305c57166d0c90acc8af83651143a1ea2b8d8ec37fe1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21adbe8bb1be87906478bc0568246e20168cc36d81178c15f4978d34008f4d6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1171700f424a275c57b4fd6f27215e2195fa27e03bbcb6f215add20a854af36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37be0b2ab48e8ac093680c3919d0a824a80a92c88cac42263dc2d89b954ad10b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2da7e4de0360fa6ef1a9678f3ce5c2c148d576881791cf003f6b47401fb461a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c8e88b4cc7a8b0930de2ef21bde48db7cb70187797a5c3bd458744c5e5929b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e997b8702035c30615be3801e7a31c6de497e16d5934bc7242c6ec133edfb72b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7184a60227033683c5b518147afe45b92c8212e2994f7457cfacfa438edac57d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0df47ef3eccfea6bb79590cfa3663f767bcec745ed3ba21825f29c3ab21764bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8584241de39f067723768e178b7824e37a4fc3f0e4772971a1bf193b3821f6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b44eab6131a60110ef9f384b742390f071521d0db0d1d1e9aedac4b983c0fb34
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a161b39de8ed50143f5d549ca4524130b99994e0548e5d4a7e1025eb690cd735
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7d2ceff297efa5e106338e14653506d024eb06a579eedd8dee671b235c6b49f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 018fdc2c113909db6776fd1f11e01761dfcb8c29e18fd1c40bccaf7be153b442
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b220af9b96b85e89afd2f151177e0693d5370567562732bbdc2fcdee29b81aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8d16272466f6abaaf91035d91c7158aef8e984a2a0a3977f9d720ffbb868b1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e0d570e7a5b4443904f3b4e46bad9ee0e6142433adbd1910879f6bae4a9ab02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bb6215417996b71a753aaeae53537bf1aed8b6f62573997c01e9e09591b32ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5754eaa4af6927aa08790d2b11a8cdc509ac75e9263ee15cd07c7a528301cea6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bd4b1d8fb6ba7d5213a8b633bd17557e33b5183c8d926aa6cd71362e1a9379f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b91d25c13a8ba640d218a07a307c8f040e86281863b517b3bfb88ba28b26856
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50f22fdec421b23db58ae1e64e918662c4403151b54ac155fabfbab0ba937ddb
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            windows.exe

            • Path C:\Windows\SysWOW64\windows.exe
            • Size 598KB
            • SHA256 b7c4c773ea8a7d25405d66e11da30d0c434e603df0f5a6d2685b8b01dcffb669
            • MD5 SHA1 SHA512 SSDEEP

            memory/2564-111-0x0000000000400000-0x000000000057C000-memory.dmp

            memory/3160-187-0x0000000000400000-0x000000000057C000-memory.dmp

            memory/3392-16-0x0000000003C00000-0x0000000003C01000-memory.dmp

            memory/3392-12-0x0000000003CE0000-0x0000000003CE1000-memory.dmp

            memory/3392-4-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

            memory/3392-5-0x0000000002460000-0x0000000002461000-memory.dmp

            memory/3392-6-0x0000000002420000-0x0000000002421000-memory.dmp

            memory/3392-7-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

            memory/3392-8-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

            memory/3392-2-0x0000000002440000-0x0000000002441000-memory.dmp

            memory/3392-9-0x0000000003BB0000-0x0000000003BB1000-memory.dmp

            memory/3392-11-0x0000000003CE0000-0x0000000003CE1000-memory.dmp

            memory/3392-10-0x0000000003CE0000-0x0000000003CE1000-memory.dmp

            memory/3392-1-0x0000000002330000-0x0000000002390000-memory.dmp

            memory/3392-0-0x0000000000400000-0x000000000057C000-memory.dmp

            memory/3392-3-0x0000000002430000-0x0000000002431000-memory.dmp

            memory/3392-15-0x0000000003C10000-0x0000000003C11000-memory.dmp

            memory/3392-23-0x0000000002330000-0x0000000002390000-memory.dmp

            memory/3392-22-0x0000000000400000-0x000000000057C000-memory.dmp

            memory/4220-17-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4220-18-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4220-19-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4220-20-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4220-27-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4220-159-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4220-87-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4804-32-0x0000000000200000-0x0000000000201000-memory.dmp

            memory/4804-31-0x0000000000140000-0x0000000000141000-memory.dmp