Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/07/2024, 08:55

General

  • Target
    2bba32328f1b498b440d9ccf3dedd24d_JaffaCakes118.exe
  • Size 1.4MB
  • Sample240708-kvmq8a1gpl
  • SHA256 af66df64a1bfeee97ff007eef1914c030570a95a5d95cb6bc46a961d37daf947
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

  • win32updatesx64.sytes.net:85

Mutex
  • ***Dropex***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Win62

  • install_file

    Update_x64.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    This program is not compatible with your system

  • message_box_title

    FATAL ERROR

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3408
      • C:\Users\Admin\AppData\Local\Temp\2bba32328f1b498b440d9ccf3dedd24d_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\2bba32328f1b498b440d9ccf3dedd24d_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2004
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          PID:4920
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:1536
          • C:\Users\Admin\AppData\Local\Temp\2bba32328f1b498b440d9ccf3dedd24d_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\2bba32328f1b498b440d9ccf3dedd24d_JaffaCakes118.exe"
            3⤵
            • Checks computer location settings
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:1944
            • C:\Windows\Win62\Update_x64.exe
              "C:\Windows\Win62\Update_x64.exe"
              4⤵
              • Executes dropped EXE
              PID:388
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 564
                5⤵
                • Program crash
                PID:3872
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 388 -ip 388
        1⤵
          PID:3568

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 24af8219e09e70bb8a1da2e52b68ee559650ddcbfd6b8562c24b6e5b2b0316b2
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 334cfb8da4b1ffe615c4f2599806c436c2095f8b95df932b96813f9f7fc16d11
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7fc054cb3d9bf6a73a5fa5d3112a28b4dc2053dfa05fedb1db2525bd3d22627
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fde54e424d51d6803cbdf93ea8d6eb6f17edadeb93251826469ccf4c3fe54ec1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4e8d656c47b4fc163bcfd8485fc39603494bdf750707e9ca5e1c3dd2051eaa5f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db628ec1a55aef8f235e6e6866b34216f5cf9ac18729b267accebd17a38a759b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ac7f7ee8d57fffa8fcfad6a638b4af1220e0b56194b3f1f1c51ba64ce8a2955
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9035f8c5ada702ecccf8a2c4d42a3a20a33d09b7cf80f7dd4cd2e4b63c423ea6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 312bf56128c14378493cc627e999d45604b953ce3fae2ae1fe66a3a35e96b67f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 03e65b03116eca70cbed32d8b0d7de18deb05c8aa007ec39d6bb6a224d7fda4c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f68ebe8ec5cee53ab96e0e5c4ead4a5b5b96d4a593fc2388005acaec77e40a26
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa8c208b4c035eb7eb7c6529b374afabd7b776c75c7a1ffc6eef9f536969dbde
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7449e180b5e6b0215867abd0de7618e5baedba0102e9eaed685f162e11eac711
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84e5f27b6c51b318ca0b6a4df61f3bb1abfef4b75996e90c396fcc96bca07d34
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bdb64b65cb85995c2cf773eff9d30b2db8bf7c1996e0176008aef96045863405
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5a74b33f7a15731e11f6158aa43b3d836d358b8e9d3af9d106c3cba78fd62a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 20cc9edc5ce212116322f2d27171fc72106fe4f912dbfde9899e03dc082480a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e4131c4491a5f5903e5dd48bc1675f5cebba5e1dad379e680be66be5e280b86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b52755c613f3dbea38d8e6814030edb615031b2b0df19369f3c99231cc941f94
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 388bd094ff65dc8a26472bfb8aa698585e689d0d9369b965f72b0c15db891ae1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 604189ad0c7fe089dcd6e65090738b7eb9638b770b98f48f9fa8858b5162982c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bfb030af4f93680130acf697ba3945531c25aae632d2c1d7060622df989e7e4d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8bc80a1229490c7ef254fc25ee8fe36b3f79df54edc84822b9af72454d9e967e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0e574f591087a7525906550d935615713db92dcca8f200f63b70f318b741443
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2af89eeff56ef7aba9d71cf1141b709e88d8d5e03bbf11ec36709baec7bd6251
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c304022be141f19fa36df3fe71cfb22ff932b7ad4c4156c19827312a12e3f87
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f543c67ec34e9432cf148958993e263349517a1872c62698fd5a54e8b43be08c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3db1b6f44415b387c45d690ed943ca11a72c8f4dee3cc4ae5b0237382a6e311e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d51001efd4e5f4f42e615eb409c70df3571dffb9a528e0d7f7a3f47144e6a46
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2367dfb726ad6f3bc162cda1e5ef8cbdefc393b8ffaabe24eb2d0fd7b0145bc2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ef00dab3f9ed0c29dbbf4ed1857ba2c2270297252230a0eac93d788e919fc36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d13b1ea0f129fd0c699ca9eb36018dbd1719c0af138c96634533eec904ae51fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44d25e48da8b348011d1a50ebb55f8b8a9f441598388d65cd4cb8d02fcd49886
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d1114c02bd3c886828d21d97081c387bdfc766efbba802b9056f27f26b6aab0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 39c254ec93b599fea9803c590bcf87e62b8ff678fcd9ba82a5ae01743c1055f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d960ac4119b7ad96751f1b00ecf9ef7aaaff59d7f06a8648298ce31e1790e0f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6346be855e6c2dd7e65c774e667b881b8ceb92b45a92c320a7fd33cc9fb2f83
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f43fcd4222368f32c0508005b8876d49b27b8708c48f33f5c71ab0ff369bedfc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0cf0fd713ab30beab47fd96aaa801ab98b8ba27773e73dc7e36f4e9e0c040fec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a04987a22cc6d7c33e7d448875eefa8c172e8afbc38c2768d66d405fe29e4e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf2a8b8cd3777d6f00e050e56c334920818bb27fa3f33adb9063c1dc57cf0624
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0d466125383257e6ea671ab457187628802324e5751562db77a844af76639e58
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7920d820c59b87ed4634e9004bbfa380b085e694f3ac236294cf9b33d8c3fd20
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a8fadf9036612e4c2d8186bb9e85438395384bc40f6164aa3cd2f14e8e2676e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c16d54c90321c993c9b663553cdb039b0345694e621d8213388149dbf4f7b0b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 68e08b0a65171c4bc8c9098a54eaff1415642dba78f2f63dc02dd36cb7bbed2e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e4acf55c412afcad83085b8e6de628d602c34df794cf81a6b19698838841889
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 00c3ba5ff920ccd109b9cbd98f4c0454b051967c88614af8de77f6a8858c89cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 873afdcc7c1ebb9a3e7be7b8ef8a3396eec202c0f4885a9e8c97cfcb7f0f7b5e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0fe47c97bf874238de23f73b6139296e12ede4742609c1cd7339efbb518ea313
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40cf30d592ced5da61d5eb4ce3af69f311bdd845a19770e6e5452422829a0ed4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd60ade0597d04130b33109005eadb653262d244a0178fbc071062cf8e6c6e47
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d96aa580e0ef3e6ba95f0299abc5a2f84d3ceecffe4c92aecab95751b2b38a06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 31c62edab6e7f497e7f2f113b188cfdde3fbffb58871c79e7c7b85c95ea503fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a0e30905a1c9ef667f1571cb6e3276fdbcaf843659bfad2d9ccb3640a522c8d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4e448382242dfb97e76092226043bb41637c9fa8f3b6b007b926a11e6b360d04
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ffeea8771fa93e55e07f29b5165a633dfd317a25a79d598890edd29f62bdf0d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2076fd09b24a9b92a6d72ef87831bd9046f12a278dfed788998b703a785a3338
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b535676041880e7f4069ace80ed2191416d2ef8093c783bc1e8e546309b114a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d688d6635207234fd4d8e8f05c71861bc721ab284b91a6663eb8b2c21c61fce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e4b214737ec9fd2611b0c323e83a05c440d5f9eb505b530d26ec96051368141
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 02f4d597b8a6e6fc85326ac394c1a9f991a77dba038ed3d780576bc2ab851152
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0c2197f7127e2e1208dcf2d4d023e082d0a615b559dc991c80857d118f539db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6141a645adb502ede0009f605fadbeab83d4a043f53d341f9d8f2eca63620b4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 298d9dcdd96292d2035b4106a11e4cb7459fcd40674284d3ae40a6bc0736c1ec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9044ed386cab3f1a72eadea900687d3d85be74e6e5ac5aee1158d6e586776b57
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46c752de3f57785d4b78f3b97049991a43be4d6ca6180081393bf27b5923d87b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 45e73b652b3635ec0e9966530e1c5e71fec6662e7f2f879c23ad42fbb007e569
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1a181df9efdd814dbf45c01cb14efcbdbdb6fee71ee7bbb612383404837ff70
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 edfd9171a2ebd15da7f179e3afb49fa4211890612177f83747ec82f97653f71c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7dc1d934abb0101d3a95d77fd95843ea4cbdab0889c082b05f608e49627ffe75
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 274ae483f5a8186e3321b8889227a41f7e3bc0db1296f3b96104649e831f80c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b8999ff4ead554de476cbca89826d88994a111a3ecf032f150411ab4335f1a14
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4e67c9d3328e5d74f5d1fbf21fd9f0c24f8cb3f6a311d0a1edc2991ea934f7a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01ba116a92f2627387f8e986919192c0dc3d2021558664a871b97e0cc49acb8d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f966b9df7abfc3c426c46de8074a4893d8e19de01d5d9d63a9bc8f04a26c4f92
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b653844dffa96b701877952370319a66040c91c7aac081aaef2c12939ffed6ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5adc504ad457cf66c6764fefc4916993203180e1a431f3423e9adad06075d15
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 efb6f756e4561f7d776df8654026ab19d3d929ad7acf2b2f6cf5a8791a58d971
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d0fd99bf173d3385cacb5f539c052fcc3caac32030582d2eb6edbff719fcaaed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ae2444eec21cb46bc494b3c4ed838dbf11d552d9101233b0efcbbf4eebca133
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 320801c41de52db809848ee69d7234d6a10d9f557b233a2da1e90ac3d47e4a92
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f1f41685c962a2f9c3399b8811b82dc35930d04473db031f1e77d091dda54d14
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 822d090338c638b76bd83fee89e81b0204651b73415b52caf2299a9893d11176
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 379e08dd583312bc8fcc1a7db2b02f171daa9b7d662a78b53b275f9f71711f4e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b089a5df8b7802be06fc7d73ed249ca670529ae5e2fb78f5ed1c4c36ec92126f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ba485f975664bacf1d7bfb2c09eea04d771ee64b43c71152309bd472bde6a94
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf7e8f9e6f6fa657b9ec5f493fc6f6b6f284a4913fa722c9dcd355d61ffd2a44
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f88f432a741e464bcbb20bc77b7a8b895b208fcd72434a0b060ab5a8ee76375
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8107d368467b35e70630da46d1b1cb884ff21862f4cb05a3d54e674134cc9d57
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5433acc6257c743a9954a534cb53a2d89b20c2f58a3b0d8313126f26565450d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e35da353204dd875a4f697821e52bf8bf78ae96ba726000aab3cf874a5d1789d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11859114942cdaf6261f003a58762855acb29205dd4598395c8886092e7a0ea4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b0e0ecacdb5c192a678c6b6f94daf6674165cc25003b6f1be70b711a86a8e63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 769d29786a5441d5bf02e18b00d1da3244227dc02e32099289a4bd30803a0405
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dee88a7c677dcd04ee6a592a1c3743cb30f9c58418d8dc7f3f3f7f5b93e67a85
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9303a9f2ae6665c11a70b32ef85ecc0edc988cc504a3aff44109f3d247cd0945
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad67476df2a6c01a6b26ca30eb4835fce1da76a0a6bb5cc797a707ebdd92dd54
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d295c92d64c1cd66489ae33d4d432f896689ae5f5086b019cc14658a60b22e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ffc16a4a0b8e8e3380301fec03902184d72c3bca00c9c84c4e2e3698a54779b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4f7644bb19f47733b7888a1f01a3476b39e39c782821389ba8e99455ad2435f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c111ed56da0918804cecc68ceabadf9447b30e2787d41ef7cebb1f8e0f3027d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 12741067a40862a10e1443267ec8f9600b3b657a24a138be2c06e801d2844c39
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65304120d43816f023b3102eb67529d25a661f521f0213ebac4a82603ad7ac34
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 073ea5978727a6d1ca8a9536963f8fc6ef15d8a51b2bddd3a165dd5b9cb05134
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59e0d20d82598ba73aef882b705ad6aa5423277323848ad3794c669836897176
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43f03df0de0b3249748cbbfabe63bd65cd92a4ee207b17e10871927e4ab35596
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d6e6f1ce45e23c116973d76f1ef5cd3ff52346e606ba952a2edc92a3415ca17
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92bdfe46fbee757c7c02a8db609026bc661025349211c8815af06e05fef0f879
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46de55f40854d9b5749bdff0f90347ce9bccc033741d7a4b06ce325d9fa84c97
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c23566672a2a3e4a06c7b1cd7dd24eae1756b5063e2d509d4751361547250461
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1080a27913df12c6f02e9f89e331f4aa90ea787fb1e2ed733bb31bd6de7b0dd9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 169001bac7403eff6a17ba83a639ddb31ef4277e31ed964087480e4ac1e3bb4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25f2387ddda5e9e9193617805d7305930e56ec83104924d7a65051b77f4650d2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 edfb18aec3b8d5417368f44200d9f4bc6caf03824663504fa7acddd8e084c374
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 786e9be653867af8968652ff81338fa1a6b6b2edce1e020527a7aa90dbf38da2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c8d290d1d90b494fabbd4dfd58c88e7f8214ab8abccfb9a3cc97de030532f60
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 565cb451d5a726a76d82a20cb37a80135871df3f6103e87f03b58011d0f7d04c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 464a3f68162c859a35f2412a19c028ef0e5fcfb3b88da8ce42beb9bf57486048
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4324ac0993ba53744fe7be889fe77b1099dabf3dbddeb6ce324ec511581e058e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 978a5fdb42bfb530627f07d0b07d3991db040c38c321406b0c992ba90b3b56a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58a8183ee5555b4dc9b59b6038696950b061199be58de44f500fa4d229859cbb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97c5c24cae7725d6343815010d0e6d1049d41f9f0dcecd77fb28a8366171aab6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65df15bbdfcccb573108fd7171b868514e8d21abd87a88ddd3ecc47de08b5b92
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bc61db3bbfd5be192d890e6b9b4ee9c158b727d27dfaa1f74b08d64005644771
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d4e240b5f15ed4dde76506a61eaa75259c80cd89d562ed90ca1f69db296fe66
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea6877d84a320acb2525975790057730502e40ced416547e80d7703966571d90
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f89c6cb4950f6fad325e378fd6414c66877bb5d0c4e12543f03976d54f69d248
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c7c3b3cb63cff3538227c3080e985d0115ae86d750353525b59b9fa1bce0226
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 19ea72f5c8b2bb66388153526055f33e32ba41fdac707a404a6fd65ac3a6bbc2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e594d4825a0fa7226505542e38c7ddc1d8f1a00f05d9e9946b62024052507887
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd8122248289be077093b98180d8079a2ef047756db3b8e3ebbd043871649f94
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7bc0c26b5365ca5a5fc4eedc7cf27054c6ac57778ca46e53fc246d2924e35c6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16e5b87a2996da7803f42e5c6e8b1385ab01a662ea6da7c461b3baa14881ccee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e0b2c618750beec9cc6cdade91c373eca5f1d708e91ffedd837fbc89ecb4d00
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d0aa47f8e81c1ca813a41c0ba6ca19f611b15c5f7deb8bed3b54dad1ec2f28d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13ae3754f3641c588c2a2815d4e0f52af11123afe61d3059372218c4fdade925
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 35c929a35529c3ea8fcebdc126cb317426498effeb5f64311e4eab8f642c84d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1701cc441c809b8dda30e970f5cdf16c56b2e371c86f3469087b7c78ce8c83d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf76424d244e12e6d0848b659c29e5790a57e677288c1a101070aeb2132846c6
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              Update_x64.exe

              • Path C:\Windows\Win62\Update_x64.exe
              • Size 1.4MB
              • SHA256 af66df64a1bfeee97ff007eef1914c030570a95a5d95cb6bc46a961d37daf947
              • MD5 SHA1 SHA512 SSDEEP

              memory/388-162-0x0000000000400000-0x0000000000564000-memory.dmp

              memory/1944-849-0x0000000000400000-0x0000000000564000-memory.dmp

              memory/1944-138-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1944-1306-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/2004-4-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/2004-139-0x0000000000400000-0x0000000000564000-memory.dmp

              memory/2004-0-0x0000000000400000-0x0000000000564000-memory.dmp

              memory/2004-65-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4920-68-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4920-623-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4920-8-0x0000000001270000-0x0000000001271000-memory.dmp

              memory/4920-9-0x0000000001330000-0x0000000001331000-memory.dmp

              memory/4920-67-0x0000000003DA0000-0x0000000003DA1000-memory.dmp

              memory/4920-69-0x0000000024080000-0x00000000240E2000-memory.dmp